feat(ui): warn when the running worker predates the selected repo's merged HEAD

Stamps ClaudeDo.Worker's build with its exact git SHA (SourceRevisionId ->
InformationalVersion) and exposes it via a new GetWorkerBuildInfo hub call.
For the currently selected list, the shell compares that SHA against the
list's git HEAD (GitService.IsAncestorAsync) and shows a persistent footer
banner -- never auto-clearing, never shown on an unrelated repo or when the
ancestry can't be determined -- so "verified against a merge" claims aren't
silently made against a stale process. No auto-restart; the banner just
offers the existing RestartWorkerCommand.

src/ClaudeDo.Ui/ViewModels/IslandsShellViewModel.cs

@@ -5,6 +5,7 @@ using System.Threading.Tasks;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using ClaudeDo.Data;
+using ClaudeDo.Data.Git;
 using ClaudeDo.Data.Models;
 using ClaudeDo.Ui.Localization;
 using ClaudeDo.Ui.Services;
@@ -34,6 +35,7 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
     private readonly UpdateCheckService _updateCheck = null!;
     private readonly InstallerLocator _installerLocator = null!;
     private readonly WorkerLocator _workerLocator = null!;
+    private readonly GitService? _git;
     private readonly IDbContextFactory<ClaudeDoDbContext>? _dbFactory;
     private readonly Func<WorktreesOverviewModalViewModel> _worktreesOverviewVmFactory = () => null!;
     private readonly Func<WeeklyReportModalViewModel> _weeklyReportVmFactory = () => null!;
@@ -102,6 +104,11 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
     [ObservableProperty] private string? _updateBannerLatestVersion;
     private bool _bannerDismissedThisSession;
 
+    // Persistent (not auto-clearing) banner: the running worker predates the selected list's
+    // merged HEAD, so "verified" claims made against the current process are stale. ClaudeDo-repo
+    // only — see RefreshStaleWorkerCheckAsync.
+    [ObservableProperty] private bool _isStaleWorkerBannerVisible;
+
     [ObservableProperty]
     private double _windowWidth = 1280;
 
@@ -212,7 +219,8 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
         Func<MergeModalViewModel> mergeVmFactory,
         Func<RepoImportModalViewModel> repoImportVmFactory,
         MissionControlViewModel missionControl,
-        UsagePillViewModel usagePill)
+        UsagePillViewModel usagePill,
+        GitService? git = null)
     {
         Lists = lists; Tasks = tasks; Details = details; Worker = worker;
         MissionControl = missionControl;
@@ -232,7 +240,9 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
         _usageMonitorVmFactory = usageMonitorVmFactory;
         _mergeVmFactory = mergeVmFactory;
         _repoImportVmFactory = repoImportVmFactory;
+        _git = git;
         Lists.SelectionChanged += (_, _) => Tasks.LoadForList(Lists.SelectedList);
+        Lists.SelectionChanged += (_, _) => _ = RefreshStaleWorkerCheckAsync();
         Tasks.SelectionChanged += (_, _) => Details.Bind(Tasks.SelectedTask);
         Tasks.NotesRequested += () => Details.ShowNotes();
         Tasks.PrepRequested += () => Details.ShowPrep();
@@ -285,6 +295,7 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
             }
         };
         Worker.WorkerLogReceivedEvent += OnWorkerLogReceived;
+        Worker.ConnectionRestoredEvent += () => _ = RefreshStaleWorkerCheckAsync();
         Worker.PlanningMergeConflictEvent += OnPlanningMergeConflict;
         Worker.PrimeFired += OnPrimeFired;
         _clearTimer.Elapsed += (_, _) =>
@@ -324,6 +335,8 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
         _connectTimer.Dispose();
         _primeStatusTimer.Stop();
         _primeStatusTimer.Dispose();
+        _staleWorkerCts?.Cancel();
+        _staleWorkerCts?.Dispose();
     }
 
     private void RefreshBannerFromStatus()
@@ -343,6 +356,57 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
         }
     }
 
+    private CancellationTokenSource? _staleWorkerCts;
+
+    // Re-evaluates the stale-worker banner for the currently selected list. Cheap (one hub call +
+    // up to two git subprocesses) and only ever runs for a git-backed list, so it's fine to fire on
+    // every selection change / reconnect rather than caching.
+    private async Task RefreshStaleWorkerCheckAsync()
+    {
+        _staleWorkerCts?.Cancel();
+        var cts = new CancellationTokenSource();
+        _staleWorkerCts = cts;
+
+        var stale = await ComputeIsStaleWorkerAsync(Lists?.SelectedList?.WorkingDir, cts.Token);
+        if (cts.IsCancellationRequested) return;
+        IsStaleWorkerBannerVisible = stale;
+    }
+
+    private async Task<bool> ComputeIsStaleWorkerAsync(string? workingDir, CancellationToken ct)
+    {
+        if (_git is null || Worker is null || string.IsNullOrWhiteSpace(workingDir)) return false;
+
+        try
+        {
+            var buildInfo = await Worker.GetWorkerBuildInfoAsync();
+            var buildSha = buildInfo?.BuildSha;
+            if (string.IsNullOrWhiteSpace(buildSha)) return false;
+            if (!await _git.IsGitRepoAsync(workingDir, ct)) return false;
+
+            var head = await _git.RevParseHeadAsync(workingDir, ct);
+            var isAncestor = string.Equals(buildSha, head, StringComparison.OrdinalIgnoreCase)
+                ? (bool?)false // equal — never "stale" on a match, and no need to ask git
+                : await _git.IsAncestorAsync(workingDir, buildSha, head, ct);
+            return ShouldShowStaleWorkerBanner(buildSha, head, isAncestor);
+        }
+        catch
+        {
+            // Worker offline, dir no longer a repo, etc. — unknown, so stay quiet.
+            return false;
+        }
+    }
+
+    // Pure decision extracted for testability. isAncestor is the tri-state result of
+    // `git merge-base --is-ancestor buildSha head`: true = worker predates head (stale), false =
+    // equal or diverged (never claim "stale" on a match or an unrelated history), null = unknown
+    // (e.g. buildSha isn't a commit this repo knows about — never treat "unknown" as "stale").
+    internal static bool ShouldShowStaleWorkerBanner(string? buildSha, string? headSha, bool? isAncestor)
+    {
+        if (string.IsNullOrWhiteSpace(buildSha) || string.IsNullOrWhiteSpace(headSha)) return false;
+        if (string.Equals(buildSha, headSha, StringComparison.OrdinalIgnoreCase)) return false;
+        return isAncestor == true;
+    }
+
     [RelayCommand]
     private void OpenMissionControl()
     {