Deleting worktree branches now refuses unsafe names and targets

A worktree is a separate copy of your git repository in its own folder, on its own branch. Several things around worktrees changed:

• Deleting a worktree branch now refuses a saved branch name with characters a worktree branch never has.
• The branch is kept when deleting it could make git write outside the repository.
• When a worktree is kept, a failure to move into its folder is now reported.
• Creating a worktree can skip resetting an existing one to a fresh starting point, and says when it did.
• The tmux launcher now passes CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG as an environment setting at the start of the command.

Before, the branch was deleted with no checks on its name or target. Separately, in this release the description of the Workflow tool now says "a message from the system" where it used to say "system-reminder".