Session-create unrevert can restore a snapshot from another worktree #35255

Summary

When multiple checkout roots resolve to the same opencode project identity, session-create unrevert can restore a snapshot tree captured in one worktree onto a different current worktree root.

Observed impact

With opencode 1.17.9, a stale snapshot captured in a throwaway apply worktree was later restored by session-create in the main checkout because both directories shared one project identity. The main checkout was overwritten with the foreign tree as unstaged file changes and untracked files, while the repository git metadata remained untouched.

Expected behavior

A snapshot restore should be scoped to the worktree/root where the snapshot was captured, or unrevert should refuse to restore when the current worktree root differs from the snapshot source. Project identity collisions should not allow cross-directory whole-tree restores.

Local mitigation

The affected workspace disabled filesystem snapshots via project config to remove this replay path.