Add agentws worktree-management binary

agentws manages per-branch git worktrees for the unkin-agent user: it clones
repos into the source root (~/src/prodenv/<repo>) so branches are visible in
Ben's main checkout, and creates isolated worktrees under the worktree root
(~/.cache/agentws/<repo>__<branch>).

- New internal/agent/git.go: small, testable git helpers shelling out to the
  git binary (clone/fetch/worktree add/remove/list/prune, branch + config ops,
  porcelain parsing, path sanitizing). No go-git dependency.
- New cmd/agentws: new / list / rm / clean / token / credential subcommands.
  Auth uses an ephemeral git credential helper (agentws credential get) so the
  ~1h Gitea token is never persisted in a remote URL or config; per-worktree
  config keeps the shared checkout's identity untouched.
- Wire agentws into Makefile, scripts/build-rpm.sh, packaging/nfpm.yaml (binary
  + bash/zsh/fish completions), .woodpecker/release.yaml (cross-compile + assets)
  and .gitignore.
- Tests: table tests for parsing/sanitizing/dir-naming, a real temp-git repo for
  the worktree lifecycle, and hermetic cmd tests (bad input + credential-helper
  host guard) that never touch the network.
- Document agentws in README.md and AGENTS.md.

packaging/nfpm.yaml

@@ -36,6 +36,12 @@ contents:
       mode: 0755
       owner: root
       group: root
+  - src: dist/agentws
+    dst: /usr/bin/agentws
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
 
   # Shell completions (generated by scripts/build-rpm.sh before packaging).
   - src: dist/completions/agentpr.bash
@@ -62,3 +68,15 @@ contents:
     dst: /usr/share/fish/vendor_completions.d/watchpr.fish
     file_info:
       mode: 0644
+  - src: dist/completions/agentws.bash
+    dst: /usr/share/bash-completion/completions/agentws
+    file_info:
+      mode: 0644
+  - src: dist/completions/_agentws
+    dst: /usr/share/zsh/site-functions/_agentws
+    file_info:
+      mode: 0644
+  - src: dist/completions/agentws.fish
+    dst: /usr/share/fish/vendor_completions.d/agentws.fish
+    file_info:
+      mode: 0644