Summary

• When in a detached HEAD state (e.g. Codex's default worktree mode), sandbox operations previously failed because the CLI used a bare "detached" sentinel string that the server couldn't resolve as a git ref, and caused session key collisions across different commits.
• GetCurrentGitBranch now returns detached@<short-sha>, giving each detached commit a unique session key and a recognizable identifier in sandbox list output.
• GetCommit now uses the same merge-base logic for detached HEAD as it does for named branches. This means the server clones at the nearest ancestor that exists on the remote, and local-only commits are synced as a patch — matching the existing behavior for unpushed commits on named branches.
• Added GetShortHead() helper to the git client.

Test plan

• Unit tests pass for SessionKey, ParseSessionKey, SandboxTitle, IsDetachedBranch, DetachedShortSHA, and GetSessionsForCwdBranch with the new format
• GetCommit detached-head-diverged test updated to expect merge-base instead of raw HEAD
• Full ./internal/cli/ and ./internal/git/ test suites pass
• Lint passes
• Manual: create a detached HEAD worktree, run rwx sandbox exec, verify it works end-to-end
• Manual: verify rwx sandbox list shows detached@<sha> in the BRANCH column
• Manual: make local commits on detached HEAD, start sandbox, verify it clones at remote ancestor and syncs changes