harden trail worktree checkout edge cases

Address final-review findings: fail early with a clear error when the trail's branch is already checked out in a non-managed worktree (previously a raw git fatal after the ignore rule was written), confine .worktreeinclude copies to the new worktree via os.OpenRoot so tracked symlinked directories cannot redirect writes, bound the branch fetch with the same 2-minute timeout as other remote operations, and document the extra --force meaning in the flag help.