修复: 代码审查发现的安全与兼容性问题

- git_worktree: commit config 改用 --local 避免污染全局 git config

- git_worktree: merge-tree 改用旧版兼容语法(三参数替代 --write-tree)

- coordinator: executor 'static 约束加注释说明(JoinSet spawn 要求)

- coordinator: Token reserve 按层 SubTask 数累加(原固定 10k 不准确)

- coordinator: 更新结构体注释(反映当前并行实现而非 Phase 1 串行)

- 39 个测试全绿,行为零回归

crates/df-ai/src/git_worktree.rs

@@ -129,14 +129,14 @@ pub fn commit_worktree(wt_path: &Path, message: &str) -> Result<(), WorktreeErro
         // commit 失败可能因无 user.email 配置(测试环境),尝试自动配
         let stderr = String::from_utf8_lossy(&commit.stderr);
         if stderr.contains("user.email") || stderr.contains("user.name") {
-            // 降级:设置临时配置后重试
+            // 降级:设置 worktree 局部配置(--local 不污染全局 git config)后重试
             Command::new("git")
-                .args(["config", "user.email", "devflow@ai.local"])
+                .args(["config", "--local", "user.email", "devflow@ai.local"])
                 .current_dir(wt_path)
                 .output()
                 .ok();
             Command::new("git")
-                .args(["config", "user.name", "DevFlow Agent"])
+                .args(["config", "--local", "user.name", "DevFlow Agent"])
                 .current_dir(wt_path)
                 .output()
                 .ok();
@@ -167,23 +167,23 @@ pub fn merge_branch(
     plan_wt_path: &Path,
     subtask_branch: &str,
 ) -> Result<MergeResult, WorktreeError> {
-    // 先用 merge-tree 预检
+    // 用旧版兼容的 merge-tree(base branch → 输出冲突树)
+    // --write-tree 需 Git 2.38+,改用三参数 merge-tree <base> <branch1> <branch2>
+    // 成功(exit 0)= 无冲突可自动合并;非0且有输出 = 冲突
+    let base = "HEAD";
     let precheck = Command::new("git")
-        .args(["merge-tree", "--write-tree", "--messages", "HEAD", subtask_branch])
+        .args(["merge-tree", base, subtask_branch, base])
         .current_dir(plan_wt_path)
         .output()
         .map_err(|e| WorktreeError::GitFailed(format!("git merge-tree 失败: {}", e)))?;
 
-    // merge-tree --write-tree 成功(exit 0)= 无冲突可自动合并;
-    // 非0(冲突)且 stdout 非空 = 有冲突
-    if !precheck.status.success() {
-        let stdout = String::from_utf8_lossy(&precheck.stdout);
-        if !stdout.is_empty() {
-            return Ok(MergeResult::Conflict {
-                branch: subtask_branch.to_string(),
-                details: stdout.to_string(),
-            });
-        }
+    // merge-tree 输出含 conflict marker(<<<<<<<)时表示有冲突
+    let precheck_stdout = String::from_utf8_lossy(&precheck.stdout);
+    if precheck_stdout.contains("<<<<<<<") || precheck_stdout.contains("=======") {
+        return Ok(MergeResult::Conflict {
+            branch: subtask_branch.to_string(),
+            details: precheck_stdout.to_string(),
+        });
     }
 
     // 无冲突,执行实际 merge