Introduce worktreeFilesystem, a wrapper around billy.Filesystem that
calls validPath on every mutating operation (Create, OpenFile, Remove,
Rename, Symlink, MkdirAll). This ensures dangerous paths like .git/*,
../, and git~1/ are rejected regardless of which code path writes to
the worktree.

Backport of #2081.

Unlike upstream, the Worktree.Filesystem field is preserved as a
public billy.Filesystem rather than replaced with a Filesystem()
method. Standard usage routes through the wrapper, but a caller can
still bypass by reassigning the field; the v5 API contract takes
precedence over enforcement.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Replace the runtime.GOOS == "windows" guard in path validation with
the core.protectNTFS configuration option, matching upstream Git
behaviour. When not explicitly set, defaults to true on Windows.

This allows non-Windows systems to opt in to NTFS protection, and
Windows systems to opt out when not needed.

Backport of #2081.

Adapted to v5: validPath becomes a method on worktreeFilesystem, and
a Worktree.validPath helper type-asserts the public Filesystem field
to the wrapper or falls back to a transient wrapper at the platform
default. This avoids touching the 70+ Worktree test constructors that
build a worktree directly with a raw billy.Filesystem. Also adds
config.OptBool, copied from upstream's d0aa22f, since v5 does not
yet have the type.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Add support for core.protectHFS, which detects .git paths obfuscated
with Unicode zero-width and directional characters that HFS+ silently
strips during path normalization. When enabled, paths like
.g‌it are rejected. Defaults to true on macOS, matching upstream
Git behaviour.

Backport of #2081.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Extend path validation to check every path component, not just the
first. Single-dot components are also rejected. This matches upstream
Git's verify_path_internal which validates at every directory separator
boundary.

A non-first final .git component (e.g. "submodule/.git") is permitted
because submodule worktrees contain a .git pointer file.

The per-call-site validChange checks are removed since the
worktreeFilesystem wrapper enforces validation on all mutating
operations.

Backport of #2081.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Reject path components matching Windows reserved device names
(CON, PRN, AUX, NUL, COM1-9, LPT1-9, CONIN$, CONOUT$). The match
is case-insensitive and applies when the component is exactly the
reserved name or is followed by a space, dot, or colon (NTFS
Alternate Data Stream separator). Mirrors upstream Git
`is_valid_win32_path` in compat/mingw.c.

Backport of #2081.

Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Move the HFS+ helpers (defaultProtectHFS, hfsIgnoredCodepoints,
isHFSDotGit) into hfs.go and the NTFS helpers (defaultProtectNTFS,
windowsValidPath, windowsReservedNames, isWindowsReservedName) into
ntfs.go, so worktree_fs.go is back to just the wrapper and the
shared validPath logic.

Expand worktreeFilesystem to wrap the read-side billy.Filesystem
methods (Open, Stat, ReadDir, Lstat, Readlink, Chroot) plus a
TempFile blocker, with errors annotated by the operation that
rejected the path. Read operations use a new validReadPath helper
that treats the worktree root ("", ".", "/") as legitimate while
delegating component validation to validPath. validPath grows a
byte-position-agnostic control-character check at the start so
ASCII-control bytes are rejected before the component loop, matching
the gate in upstream Git's verify_path_internal.

Backport of #2081.

Bundled here is a TestWorktree test update that should logically
have been part of the wrapper-introduction commit: the assertion
now type-asserts w.Filesystem to *worktreeFilesystem and compares
the embedded Filesystem against the input, since v5 keeps the
field public and assigns the wrapper to it.

Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Validate the symlink target as well as the link path so a symlink
cannot be planted whose target traverses out of the worktree, and
silence the unused-parameter lint in TempFile (it stays a hard
unsupported-operation rejection).

Backport of #2081.

Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

Tighten the prefix gate in windowsValidPath so that bare ".git" is
no longer rejected here. validPath already refuses root-level or
non-final ".git" components on every platform; the windows-side
check only needs to catch the disguised variants (".git " /
".git." / ".git::$INDEX_ALLOCATION") that NTFS would normalise
back to ".git". Without this, a submodule worktree's ".git"
pointer file failed the Windows wrapper guard.

Backport of #2081.

Signed-off-by: Paulo Gomes <paulo@entire.io>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>