Fix opencode server registry identity to use main repo root

[proboscis]

Summary

• Normalize opencode server identity paths in daemon so worktree paths and main repo paths resolve to the same registry key.
• Add project-identity health checks (IsServerRunningForWorktree) in server ensure/health paths.
• Normalize persisted managed-server DB keys and add legacy-key migration/cleanup behavior.
• Add architecture semgrep guardrail to prevent passing worktree paths to ensureOpenCodeServerRunning.
• Add regression tests for worktree-path normalization and DB-key normalization.

Acceptance Criteria Evidence

1) ensureOpenCodeServerRunning resolves worktree paths to main repo root

• Implemented at internal/daemon/socket.go:834 (normalizeProjectRoot) and internal/daemon/socket.go:860 (ensureOpenCodeServerRunning entry normalization).

2) getOpenCodeServerPort does the same normalization

• Implemented at internal/daemon/socket.go:1150.

3) Only one opencode server is used per repo across worktrees

• Added regression test: internal/daemon/opencode_server_project_root_test.go:12.
• Test command:
  • go test ./internal/daemon -run "TestEnsureOpenCodeServerRunningNormalizesWorktreePath|TestPersistManagedServerStartNormalizesProjectRoot" -count=1
  • Output: ok github.com/s22625/orch/internal/daemon 0.934s

4) managed_servers SQLite key uses normalized repo root

• Normalization added in persistence/update/delete paths:
  • internal/daemon/managed_servers_db.go:264
  • internal/daemon/managed_servers_db.go:282
  • internal/daemon/managed_servers_db.go:302
  • startup migration in internal/daemon/managed_servers_db.go:331
• Regression test: internal/daemon/managed_servers_db_test.go:96 (TestPersistManagedServerStartNormalizesProjectRoot).

5) Semgrep rule prevents worktree paths passed to ensureOpenCodeServerRunning

• Added rule: .semgrep/architecture.yaml:700 (daemon-no-worktree-path-to-ensure-server).
• Updated daemon call sites to pass repo-root variables.

6) make lint passes with no new violations

• Command: make lint
• Output excerpt: Scan completed successfully. Findings: 0 (0 blocking)

7) Existing tests pass; add test for two worktrees same port

• Added tests:
  • internal/daemon/opencode_server_project_root_test.go:12
  • internal/daemon/managed_servers_db_test.go:96
• Daemon package tests pass:
  • go test ./internal/daemon -count=1
  • Output: ok github.com/s22625/orch/internal/daemon 5.220s
• Full repo tests currently have pre-existing failures outside this change:
  • go test ./... fails in internal/cli (TestApplyConfigDefaultsFallbacks) and test/integration (opencode integration startup), while internal/daemon passes.

8) go build ./... passes

• Command: go build ./...
• Result: success (exit 0).

Issue

• References: orch-445

[proboscis]

Final validation summary for orch-445 (commit 1527565)

Implemented:

• Normalized server identity key to main repo root via normalizeProjectRoot() inside:
  • ensureOpenCodeServerRunning()
  • getOpenCodeServerPort()
• Updated run-launch call sites to pass repo root (or normalized root) instead of worktree path.
• Normalized managed-server persistence keys (managed_servers table) and added legacy-key cleanup/migration on startup reconciliation.
• Added semgrep architecture rule daemon-no-worktree-path-to-ensure-server to block worktree-path call sites at lint time.
• Added/updated daemon tests for normalization behavior and compatibility.

Acceptance criteria evidence:

• One-server-per-repo behavior across worktrees:
  • go test ./internal/daemon -run 'TestEnsureOpenCodeServerRunningNormalizesWorktreePath|TestPersistManagedServerStartNormalizesProjectRoot|TestReconcileManagedServersOnStartupAdoptsHealthyServer|TestReconcileManagedServersOnStartupRemovesDeadRecord|TestReconcileManagedServersOnStartupKillsUnhealthyProcess'
  • Result: PASS
• Managed server DB normalized key behavior:
  • Covered by TestPersistManagedServerStartNormalizesProjectRoot and startup reconcile migration logic.
• Semgrep enforcement:
  • make lint
  • Result: PASS, 0 findings
• Build:
  • go build ./...
  • Result: PASS
• Daemon package regression check:
  • go test ./internal/daemon
  • Result: PASS

Full-suite note:

• go test ./... currently fails outside this change scope in:
  • internal/cli: TestApplyConfigDefaultsFallbacks (invalid config schema EOF in temp fixture)
  • test/integration: opencode startup/health-check related integration expectations
• The modified daemon package and issue-specific tests pass.

Issue reference: orch-445