Fix opencode server registry identity to use main repo root

[proboscis]

Summary

• Normalize opencode server identity paths in daemon so worktree paths and main repo paths resolve to the same registry key.
• Add project-identity health checks (IsServerRunningForWorktree) in server ensure/health paths.
• Normalize persisted managed-server DB keys and add legacy-key migration/cleanup behavior.
• Add architecture semgrep guardrail to prevent passing worktree paths to ensureOpenCodeServerRunning.
• Add regression tests for worktree-path normalization and DB-key normalization.

Acceptance Criteria Evidence

1) ensureOpenCodeServerRunning resolves worktree paths to main repo root

• Implemented at internal/daemon/socket.go:834 (normalizeProjectRoot) and internal/daemon/socket.go:860 (ensureOpenCodeServerRunning entry normalization).

2) getOpenCodeServerPort does the same normalization

• Implemented at internal/daemon/socket.go:1150.

3) Only one opencode server is used per repo across worktrees

• Added regression test: internal/daemon/opencode_server_project_root_test.go:12.
• Test command:
  • go test ./internal/daemon -run "TestEnsureOpenCodeServerRunningNormalizesWorktreePath|TestPersistManagedServerStartNormalizesProjectRoot" -count=1
  • Output: ok github.com/s22625/orch/internal/daemon 0.934s

4) managed_servers SQLite key uses normalized repo root

• Normalization added in persistence/update/delete paths:
  • internal/daemon/managed_servers_db.go:264
  • internal/daemon/managed_servers_db.go:282
  • internal/daemon/managed_servers_db.go:302
  • startup migration in internal/daemon/managed_servers_db.go:331
• Regression test: internal/daemon/managed_servers_db_test.go:96 (TestPersistManagedServerStartNormalizesProjectRoot).

5) Semgrep rule prevents worktree paths passed to ensureOpenCodeServerRunning

• Added rule: .semgrep/architecture.yaml:700 (daemon-no-worktree-path-to-ensure-server).
• Updated daemon call sites to pass repo-root variables.

6) make lint passes with no new violations

• Command: make lint
• Output excerpt: Scan completed successfully. Findings: 0 (0 blocking)

7) Existing tests pass; add test for two worktrees same port

• Added tests:
  • internal/daemon/opencode_server_project_root_test.go:12
  • internal/daemon/managed_servers_db_test.go:96
• Daemon package tests pass:
  • go test ./internal/daemon -count=1
  • Output: ok github.com/s22625/orch/internal/daemon 5.220s
• Full repo tests currently have pre-existing failures outside this change:
  • go test ./... fails in internal/cli (TestApplyConfigDefaultsFallbacks) and test/integration (opencode integration startup), while internal/daemon passes.

8) go build ./... passes

• Command: go build ./...
• Result: success (exit 0).

Issue

• References: orch-445