Merge fi in the object database

[chris-peterson]

Context

git-fi keeps a shared fi branch: everyone's in-flight branches merged together, so two people's conflicting work surfaces now rather than at release time. Every mutating command (--add, --remove, --force, --again) rebuilds it from scratch. This moves that rebuild into the object database — merge-tree --write-tree per branch onto an accumulator, commit-tree the result, push the sha to refs/heads/fi — instead of checking out a temporary fi branch in the caller's own working tree.

The checkout charged twice. It refused to run at all on a dirty index, so you stashed to do something unrelated to your own work, like adding a teammate's branch, and the merge never wanted local state anyway: it builds entirely from origin/ refs. Worse, the restore sat inside the success path rather than a finally, so a rejected push or a Ctrl-C left you parked on a local fi branch holding a merge you never asked to be standing on. Nothing outside the object store is touched now, so there is nothing to clean up on any path.

Closes #15. Supersedes #13, which asked for shell-quoting the untracked filenames in the merge-failure cleanup output: no files are written, so there is nothing left to quote.

Review guide

Core change, in order of criticality

1. src/readiness.ts — the walk. The merge and the conflict attribution are one traversal now: a clean walk yields the tree to commit, and a failing branch is attributed and left out of the accumulated set so the walk carries on. The previous flow ran the octopus, threw the result away, then re-walked every branch as merge-tree probes to find out who was at fault.
2. src/merge.ts — commit the accumulated tree with origin/<default> plus each merged branch as parents, then push that sha. mergeProcess loses its checkout / commit / reset / restore entirely, and the empty-branch-list case collapses into the same path rather than having one of its own.

Behavior change worth knowing about

3. A rename on one branch against an edit to the same file on another now merges cleanly. Octopus has no rename detection; merge-tree is ort, which does. The report's apology for that case goes away with the defect — test/readiness.test.ts.

Added during review

4. src/git.ts and the warning it feeds at src/merge.ts. Losing the dirty-tree refusal also loses the nudge to look at your own branch before integrating it, so warn instead when a branch the action names has drifted from the ref fi actually merges. Ahead is what costs you — those commits reach nothing. Behind means fi integrated a newer branch than your checkout. Only branches the action names are checked, so --again stays quiet rather than reporting every stale local copy of a teammate's branch.

Supporting

5. test/cli.test.ts — one test per acceptance criterion in Isolate fi merges from the caller's working tree #15: a dirty tree proceeds untouched, HEAD and the local fi branch are unaffected, a rejected push strands nothing, a SIGTERM mid-run leaves the tree as it was. Plus the tree-and-parents parity check against what the octopus merge writes for the same inputs.
6. SPEC.md — MERGE-02 inverts from the clean-index precondition to the isolation guarantee; ADD-01, MERGE-03 and MERGE-12 have nothing left to require; READY-08 is the new warning. STATUS.md and the docs/ pages follow.

Approach & trade-offs

A temporary git worktree gives the same isolation and is the more obvious shape, but it still creates something that has to be torn down, so the failure mode becomes a cleanup problem rather than a non-problem: a run killed mid-flight leaves a worktree holding the fi branch name, and the next run fails with fatal: 'fi' is already used by worktree at ... until something prunes it. It also keeps the octopus strategy and its rename blindness, and materializes a full checkout on every run, LFS smudge included.

merge-tree --write-tree is git 2.38.0 and the floor in engines.git is already 2.41.0, so this doesn't move it.

Testing

239 tests, across Node 22/24/26 on both ubuntu and windows. npm test also runs tsc and the generated-file check.