[codeforester]

Summary

Enforce the peer-directory contract for Base-created implementation and review worktrees. Issue worktree paths are canonicalized and validated, while basectl gh review fetch --root now rejects repository-contained paths, including symlinked paths, before creating directories or mutating Git/GitHub state.

This prevents unmerged worktrees from being placed inside a primary checkout, where they can interfere with workspace synchronization and repository cleanliness checks.

Issue

Fixes #2635

Validation

• BASE_BASH_LIBS_DIR=/Users/rameshhp/work/base-bash-libs/lib/bash bats cli/bash/commands/basectl/tests/gh-review.bats cli/bash/commands/basectl/tests/gh.bats — 89/89 passed.
• bash -n cli/bash/commands/basectl/subcommands/gh_branch_worktree.sh cli/bash/commands/basectl/subcommands/gh_review.sh cli/bash/commands/basectl/subcommands/gh.sh
• git diff --check

The regression tests verify nested and symlinked nested review roots fail before the GitHub mock or Git ref/worktree mutation is reached.

Demo Impact

None.

Notes

• Existing nested worktrees are not moved or deleted automatically; migration remains an explicit, preservation-first operation.
• Raw manual git worktree add remains outside Base's enforcement boundary.
• Updated the command reference, GitHub workflow guidance, and .ai-context/COMMANDS.md.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug> and matches the issue category.
• PR is scoped to one issue.
• Validation commands and focused regression proof are included.
• Documentation and AI context are updated.
• This PR fixes issue fix(gh): enforce peer roots for Base-created worktrees #2635.
• Demo Impact is explicitly None.

[codeforester]

Addressed the containment review findings in commit c7c11c7.

• Canonicalize unresolved path suffixes so . and .. cannot bypass containment.
• Replace string-prefix/glob containment matching with physical ancestor identity using -ef, which also handles symlink and case-insensitive filesystem aliases.
• Add regressions for missing-sibling traversal into the repository and literal glob characters in a peer root.

Local validation:

• 12/12 gh-review BATS tests
• 79/79 gh BATS tests
• ShellCheck passed
• git diff --check passed

Hosted checks are running on the new head.