Make worktree/branch deletion reliable: transient retries + long-path & long-filename handling

[seankearon]

Summary

Makes the branch-folder delete worktree & branch action reliable in the face of the things that were leaving worktrees half-deleted:

1. Transient git failures — locked files, ref .lock races, network blips — are now retried.
2. Long filenames / filename too long — deep worktrees that cross Windows' 260-char MAX_PATH limit are handled, with a permanent force-delete fallback when git still can't remove the folder.

Long filenames & the "filename too long" fix

Deleting a worktree could fail on Windows with filename too long / unable to unlink … Filename too long when the tree crossed the 260-character MAX_PATH limit (a deep node_modules, generated output), leaving the worktree stuck. Two-part fix:

• Long-path-aware git — git worktree add/remove now run with -c core.longpaths=true, so git's own file operations use the Windows extended-length API and can create/remove files past MAX_PATH.
• Force-delete fallback — if git still can't remove the folder, DeleteWorktreeAsync throws a typed WorktreeRemovalException and the UI offers to delete the folder straight from disk: a recursive removal that bypasses the Recycle Bin and uses an extended-length (\\?\) path so it isn't defeated by the same limit. Then it runs git worktree prune to clear the dangling registration and finishes the ticked branch deletions. It's an explicit, clearly-labelled confirmation (new ForceDeleteDialog); backing out is a NO-GO and leaves everything in place. The folder delete runs off the UI thread so the window stays responsive.

Transient-failure retries

• New GitRetry service (src/Services/GitRetry.cs) — a Polly (Polly.Core) resilience pipeline that retries transient git failures with exponential backoff + jitter. IsTransient() classifies failures via a curated set of filesystem-lock and network markers, deliberately narrow so permanent refusals (use --force, remote ref does not exist, "not fully merged") fail fast — including guarding against false positives like a worktree path that merely contains .lock (e.g. a branch named fix.lockfile-bug).
• Wired into OpenerService — worktree removal and local/remote branch deletion each run through the pipeline, narrating every retry in the flight log. Remote-delete failures are logged and reflected in the outcome rather than thrown (local cleanup is already done). Cancellation propagates immediately without retry.

Other changes

• GitService — added a GitCommandRunner delegate seam so tests can script git output (transient failures, a "too long" remove) without a real repo; added PruneWorktreesAsync.
• Docs (Docs/Features.md, CHANGELOG.md) — document the retry behaviour, long-path handling, and the force-delete fallback, named by the exact filename too long error and surfaced in the At-a-glance table.

Testing

All 193 tests pass, and a Native AOT publish is clean (0 trim/AOT warnings — Polly.Core and the new dialog are AOT-safe). Coverage includes:

• GitRetryTests — transient/permanent classification (incl. the .lock-in-path regression guard) and pipeline behaviour (retry-until-success, give-up-after-budget, no-retry-on-permanent).
• OpenerDeletionRetryTests — retries driven through OpenerService via a faked git runner.
• OpenerForceDeleteTests — force-delete removes the folder, prunes, and deletes branches against real git (and honours keeping an unticked branch).
• DeleteWorktreeTests — the full window flow through the force-delete offer, both accepted and declined, driven end-to-end by injecting a worktree-remove failure.
• GitServiceTests — asserts the core.longpaths flag is passed to worktree add/remove.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KfYxaFc4xQHTt75dhdQoWx