merge: controlled worktree creation

# Conflicts:
#	scripts/src/help.ts

scripts/src/help.ts

@@ -61,7 +61,7 @@ export function rootHelp(): unknown {
       { command: "cicd status --node <NODE>", description: "Show one node's CI/CD closeout summary across current Pipelines-as-Code consumers, including PipelineRun, Argo and runtime readiness." },
       { command: "cicd gitea-actions-poc plan|status", description: "Archived read-only CI/CD migration evidence for GH-1548/GH-1549; never use as a delivery or closeout path." },
       { command: "cicd branch-follower status|events|logs", description: "Archived migration diagnostics only; PaC-migrated NC01 lane must use cicd status and platform-infra pipelines-as-code closeout/status/history." },
-      { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
+      { command: "dev-env validate|prewarm-images|worktree add", description: "Validate D601 guardrails, prewarm dev images, or create UniDesk task worktrees with .worktreecopy local config copying." },
       { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including D601 direct, k3s-managed, and code-queue dev-only consumers." },
       { command: "auth-broker contract|health --dry-run|credential-request --dry-run|pr-preflight --dry-run", description: "Inspect the P0 Rust auth broker and CLI adapter contract without reading token values, writing GitHub, or starting services." },
       { command: "gh preflight|auth|issue|pr", description: "Run safe GitHub issue and PR CRUD/lifecycle operations through REST with body-file update replace/append, issue/comment apply_patch body patching, comment delete, token diagnostics, PR closeout preflight, hard delete unsupported, and guarded PR merge." },
@@ -580,13 +580,14 @@ function e2eHelp(): unknown {
 
 function devEnvHelp(): unknown {
   return {
-    command: "dev-env validate|prewarm-images",
+    command: "dev-env validate|prewarm-images|worktree add",
     output: "json",
     usage: [
       "bun scripts/cli.ts dev-env validate [--manifest path] [--kubectl-dry-run]",
       "bun scripts/cli.ts dev-env prewarm-images [--image image] [--target <id>] [--no-pull] [--dry-run]",
+      "bun scripts/cli.ts dev-env worktree add .worktree/<task> --branch <branch> [--from origin/master] [--copy-local] [--overwrite-local] [--json]",
     ],
-    description: "Validate D601 unidesk-dev guardrails or prewarm foundation images into native k3s containerd.",
+    description: "Validate D601 unidesk-dev guardrails, prewarm foundation images, or create task worktrees with allowlisted local config copying.",
   };
 }