fix(core): route live Bus events before Location fanout - #52922

…overy (#909)

## Summary

Repeated "Question and permission recovery is incomplete" warnings came
from CodeNomad's own ownership checks, not from OpenCode.

- **Root cause (measured on an affected Windows machine):** the native
loaded-only snapshot RPC answers in about 5 ms, but each pending batch
took 9–35 s and often hit the 30 s deadline. Every candidate directory
spawned `git rev-parse --git-common-dir` before and after the native
read, through the shared two-process Git worker. Each Windows spawn
costs 50–800 ms, and the 30-second liveness pass re-checks every
inventoried worktree (314 in the affected repository), so the queue
stayed saturated and starved other projects.
- **Git common directory without a process:** `readGitCommonDirectory`
resolves the enclosing checkout from its administrative files (`.git`
file/directory, `commondir`, `HEAD`/`objects`), mirroring Git discovery
without crossing devices. Nested bare or separate Git directories, paths
inside `.git`, Git location/discovery environment overrides and
unreadable layouts defer to Git. Each call still reads current state;
only in-flight reads are shared.
- **Per-directory isolation:** an ownership, repository-identity or
deletion-fence failure for one candidate (before or after the native
read), or a rejected returned placement, reports only that directory's
non-authoritative `error` instead of a 503 for the batch. A rejected
placement withholds capability verification.
Root/origin/connection/workspace changes, malformed or duplicate
coverage, count overflow and timeouts still fail the batch.
- **Diagnostics:** phase-only `Server-Timing` on every response;
failures log their phase without queue contents. The root candidate
reuses the root identity (7 → 2 Git identity reads).
- **Warning hysteresis:** the incomplete state and known queues are
retained immediately, but the toast appears only after two consecutive
incomplete recoveries; one success re-arms it.

## Validation

- Real-machine equivalence: **326 directories** (314 worktrees plus
other repositories and nested folders) resolve in **0.5 s instead of
60–112 s** through Git, with **0 mismatches**.
- Pending broker and Git preflight suites: **36/36**, including nested
bare/separate-gitdir, committed HEAD/commondir markers, invalid HEAD
content, dangling and backslash HEAD symlinks, and in-flight deletion
regressions. The 64-directory case drops from over 40 s (already failing
before this change on Windows) to under 1.5 s.
- Full server suite: 958/966; the two failures are load-sensitive timing
tests that pass in isolation.
- UI pending suites **42/42**; rendered interruption-dock regression
**14/14** with the new warning policy; CI restore-ownership command
**423/423**; server and UI typecheck.
- PR CI green on ebc1571 (one unrelated Windows install-fixture `EBUSY`
cleanup failure passed on rerun).

## Scope

This does not replace upstream
[anomalyco/opencode#52922](anomalyco/opencode#52922),
which addresses event fan-out across many loaded Locations. A repository
that Git refuses through `safe.directory` is now accepted by the
filesystem read; only administrative files are read.

## Autonomous Gatekeeper review

**Completed: ZERO FINDINGS at 5077a1b, plus ZERO FINDINGS on the
test-only delta to ebc1571.** A pre-PR review fixed two issues (nested
bare/separate Git directory; deletion starting during final
revalidation). The PR loop then ran five rounds and corrected four more
divergences from Git discovery (committed HEAD/commondir markers,
dangling HEAD symlinks, invalid HEAD content, backslash symlink
targets), each with a regression compared against `git rev-parse`. See
the PR comments for each round.

## Existing large file touched

- `packages/ui/src/stores/instances.ts`: approximately 2,350 lines.