CB-587: seed the snapshot's temp index from the worktree's real index

--skip-worktree is an index flag. GitWorktrees.snapshot staged into a fresh
empty temp index, which carried none of the real index's skip-worktree bits,
so add -A staged local on-disk content for files git status correctly hides
(e.g. .mcp.json). Copy the real index (resolved via git rev-parse --git-path
index, correct for linked worktrees) into the temp index before staging, so
add -A skips exactly what git status skips.

bridged/src/test/java/dev/ltms/bridged/session/GitWorktreesTest.java

@@ -5,8 +5,10 @@ import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Optional;
+import java.util.Set;
 import java.util.concurrent.TimeUnit;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -97,6 +99,36 @@ class GitWorktreesTest {
         return out;
     }
 
+    /** The set of paths in {@code git diff --name-only from..to} — used to check exactly what a
+     *  snapshot's tree changed relative to its parent, the same shape {@code git status --porcelain}
+     *  reports for the worktree it was taken from. */
+    private static Set<String> diffNameOnly(Path cwd, String from, String to) throws Exception {
+        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "diff", "--name-only", from, to)
+                .redirectErrorStream(true).start();
+        String out = new String(p.getInputStream().readAllBytes());
+        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git diff timed out");
+        assertEquals(0, p.exitValue(), "git diff " + from + ".." + to + " failed:\n" + out);
+        Set<String> paths = new HashSet<>();
+        for (String line : out.split("\\R")) {
+            if (!line.isBlank()) {
+                paths.add(line.trim());
+            }
+        }
+        return paths;
+    }
+
+    /** The set of paths a {@code git status --porcelain} listing names, stripping the two-char status
+     *  code prefix each line carries. */
+    private static Set<String> porcelainPaths(String porcelain) {
+        Set<String> paths = new HashSet<>();
+        for (String line : porcelain.split("\\R")) {
+            if (!line.isBlank()) {
+                paths.add(line.substring(3).trim());
+            }
+        }
+        return paths;
+    }
+
     private static String forEachRef(Path cwd, String pattern) throws Exception {
         Process p = new ProcessBuilder("git", "-C", cwd.toString(), "for-each-ref", pattern)
                 .redirectErrorStream(true).start();
@@ -376,4 +408,70 @@ class GitWorktreesTest {
         assertTrue(gitWorktrees.snapshot(gone, "some-branch", "msg").isEmpty(),
                 "a missing worktree has nothing to snapshot, and must not throw");
     }
+
+    /**
+     * CB-587, acceptance criteria 1 and 2. A file with a REAL {@code --skip-worktree} bit set in the
+     * worktree's own index must never enter the snapshot, even though its on-disk content has locally
+     * diverged from what is committed — that is exactly the divergence {@code --skip-worktree} exists
+     * to hide from {@code git status}, and a snapshot built from a fresh empty temp index (the bug)
+     * stages that local content anyway because the fresh index carries none of the real index's flags.
+     * The snapshot's diff against its parent must list exactly what {@code git status --porcelain}
+     * reports for the worktree — no more, no less.
+     */
+    @Test
+    void dirtySnapshotHonoursARealSkipWorktreeBit(@TempDir Path tmp) throws Exception {
+        Path repo = tmp.resolve("repo");
+        Files.createDirectories(repo);
+        git(repo, "init", "-q", "-b", "main");
+        git(repo, "config", "user.email", "test@example.invalid");
+        git(repo, "config", "user.name", "Test");
+        Files.writeString(repo.resolve("protected.cfg"), "committed-value\n");
+        Files.writeString(repo.resolve("README.md"), "seed\n");
+        git(repo, "add", "protected.cfg", "README.md");
+        git(repo, "commit", "-q", "-m", "seed");
+
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
+        String branch = "cb-587-a";
+        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
+
+        git(Path.of(wt), "update-index", "--skip-worktree", "protected.cfg");
+        Files.writeString(Path.of(wt).resolve("protected.cfg"), "locally-diverged-never-commit\n");
+        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
+        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
+
+        String porcelain = fullStatus(Path.of(wt));
+        assertFalse(porcelain.contains("protected.cfg"),
+                "test setup invalid — protected.cfg must not show in git status once skip-worktree is set:\n"
+                        + porcelain);
+
+        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
+
+        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
+        Set<String> diffPaths = diffNameOnly(repo, "HEAD", "refs/wip/" + branch);
+        assertFalse(diffPaths.contains("protected.cfg"),
+                "a --skip-worktree file's local drift leaked into the snapshot:\n" + diffPaths);
+        assertEquals(porcelainPaths(porcelain), diffPaths,
+                "snapshot diff must list exactly what git status --porcelain reports, no more, no less");
+    }
+
+    /**
+     * CB-587, acceptance criterion 6. If the worktree's real index cannot be resolved/read, snapshot
+     * must fail loudly (throw) rather than silently falling back to an empty temp index and producing
+     * a wrong snapshot. SessionManager's caller already catches and WARNs on any exception here — this
+     * only needs to confirm the failure is not swallowed inside snapshot() itself.
+     */
+    @Test
+    void snapshotThrowsWhenTheWorktreesRealIndexCannotBeResolved(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
+        String branch = "cb-587-b";
+        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
+
+        // Break git's ability to resolve the worktree's real index by removing the linked worktree's
+        // `.git` file (which normally points at the main repo's worktrees/<name>/ directory).
+        Files.delete(Path.of(wt).resolve(".git"));
+
+        assertThrows(WorktreeException.class, () -> gitWorktrees.snapshot(wt, branch, "test snapshot"),
+                "an unresolvable real index must fail loudly, not silently snapshot from an empty index");
+    }
 }