tracking: minor tool/subagent/worktree robustness follow-ups

[griffinwork40]

Summary

Tracking issue for a cluster of low-severity tool/subagent/worktree robustness follow-ups surfaced by a read-only audit. Each is small and independently landable.

Checklist

• grep lacks dead-cwd ENOENT enrichment. bash translates a swept-worktree spawn failure into a clear "working directory does not exist (deleted worktree?)" message via describeSpawnCwdError; grep does not, so it surfaces a raw spawn grep ENOENT. Evidence: grep.ts:156 (spawn with cwd, no enrichment) vs bash.ts:331-350. Cosmetic/diagnostic parity.

• edit_file read→write TOCTOU. edit_file reads at edit-file.ts:117, writes at :148, with no mtime/hash guard — a concurrent external edit between the two is silently clobbered. Bounded (single-process agent), but no staleness detection and no read-receipt requirement.

• worktreeMainRootCache not invalidated on setCwd. subagent.ts:284 caches the resolved main root per-cwd for the manager lifetime; setCwd (:369-371) mutates parentCwd but does not clear the cache, so a delete+recreate at the same path mid-session returns a stale mainRoot. Rare.

• Silent re-confinement on git rev-parse failure. resolveWorktreeMainRoot returns undefined on any git failure (worktree-read-root.ts:107-110), so the child is silently re-confined to [worktree] — the fix(subagent): grant main-repo read root to worktree subagents #416 symptom returns with no log. Consider a debug log so the degradation is observable.

• No global/adaptive rate governor; compose failFast loses sibling progress. Each fan-out site caps at 8 independently (concurrency-pool.ts:33, dispatcher.ts:137), so N concurrent compose calls → N×8 simultaneous, which can trip a low 429 ceiling. compose defaults failFast=true (dag.ts:37), so one worker's 429 aborts the whole DAG layer and loses in-flight sibling progress. Consider a shared governor and/or a fail_fast:false default for rate-sensitive fan-outs.

Severity: LOW each. Label: enhancement.

Found via a read-only tool/subagent/worktree audit.