Ephemeral worktrees missing safe.directory config causes go build VCS failure

[schmitthub]

Problem

Go's go build VCS stamping fails with error obtaining VCS status: exit status 128 inside clawker containers when using worktrees. The root cause is Git's ownership protection (safe.directory) — the worktree path is owned by claude but lives under /Users/<host-user>/..., and Go's internal git subprocess doesn't inherit any safe.directory config.

Interactive git commands work fine (clawker's shell setup handles it), but go build spawns git fresh and hits the ownership check.

Reproduction

1. clawker run with a Go project
2. go build ./... → error obtaining VCS status: exit status 128
3. go build -buildvcs=false ./... → works (but loses VCS stamping)

Current workaround

git config --global --add safe.directory <worktree-path>
git config --global --add safe.directory <parent-repo-path>

The problem with the workaround

Worktrees are ephemeral. Each clawker run or worktree creation adds a new path. Since safe.directory entries persist in ~/.gitconfig (which lives on a named volume), they accumulate as stale entries over time.

Suggested fix

Clawker should manage safe.directory lifecycle for worktrees:

1. On worktree creation: add the worktree path + parent repo path to safe.directory in the container's git config
2. On worktree cleanup: remove the corresponding safe.directory entries
3. Consider using safe.directory = * inside containers as a simpler alternative, since the container is already an isolation boundary and all paths within it are trusted

Option 3 is the simplest — a single wildcard entry avoids the accumulation problem entirely, and the container sandbox already provides the security boundary that safe.directory is meant to enforce.

Environment

• Go 1.26.2
• Git (with safe.directory enforcement, 2.35.2+)
• Clawker worktree at .clawkerlocal/.local/share/clawker/worktrees/