bug: audit shows DEGRADED due to .claude/worktrees paths in impact analysis

[jonathanpopham]

Problem

supermodel audit now correctly reports DEGRADED status with 10 critical blast-radius files — but all the file paths have a .claude/worktrees/fix-441/ prefix:

| .claude/worktrees/fix-441/src/control-plane/.../AuthenticatedUserProvider.java | critical | 1058 | 1226 | 94 |
| .claude/worktrees/fix-441/src/control-plane/.../UserRepository.java            | critical | 1005 | 1228 | 119 |

These paths should be src/control-plane/... — the worktree prefix is leaking into the analysis.

Root cause (likely)

The repo zip created by git archive HEAD is including files from .claude/worktrees/ because those directories are tracked or visible to git. The API then analyzes those duplicated files as separate entities, inflating the dependency counts and producing paths that don't match the actual repo structure.

This may be:

1. CLI-side: git archive or walkZip is picking up worktree files
2. API-side: The API is not stripping/normalizing paths from the uploaded zip
3. Repo-side: .claude/worktrees/ is not in .gitignore

Impact

• File paths in the impact analysis table are wrong (prefixed with worktree path)
• Dependency counts are inflated (duplicate files counted separately)
• Audit status may be incorrectly DEGRADED on repos that happen to have worktrees

Expected behavior

Impact analysis should only include files at their canonical repo-relative paths. Worktree artifacts should be excluded from the zip or normalized by the API.

Repro

cd /path/to/repo-with-worktrees
supermodel audit
# Observe .claude/worktrees/ prefix in Impact Analysis table