Make create, add, and delete fail safely

[nicksong-z]

Problem

A failed workspace operation can leave Git worktrees, directories, and ~/.grove/state.json out of sync. There are three concrete gaps:

• concurrent gw processes can overwrite each other's state updates;
• delete/remove may erase a path after git worktree remove fails; and
• adding several repos can leave earlier additions behind when a later one fails.

Small scope

Fix those cases without adding a transaction framework:

• Lock each state-changing operation across processes.
• Before delete/remove, reject dirty or unexpected worktrees unless --force is explicitly passed through to the workspace service.
• Do not fall back to os.RemoveAll after a Git removal failure in the normal path.
• Keep workspace/repo state when cleanup fails so the command can be retried.
• Roll back worktrees created by the current create/add operation when a later step fails.
• Remove a branch during rollback only when Grove can prove that operation created it.
• Return a non-zero status and name every repo that failed.

Acceptance criteria

• Two concurrent mutations do not lose either state update.
• A dirty worktree is never deleted without --force.
• A failed git worktree remove leaves the path and state entry intact.
• A failed multi-repo add leaves no repos added by that invocation.
• Focused tests cover locking, safe deletion, and add/create rollback.
• Existing successful create/add/remove/delete behavior is unchanged.

Non-goals

• A general transaction or journal system.
• A cleanup-pending state machine.
• A full Git/filesystem reconciliation engine.
• New JSON schemas, plan/apply, or semantic exit-code taxonomy.
• Automatic repair of every possible manual Git edit.