Worktree/cwd isolation state is shared and racy across sibling background sessions launched from the same parent job

Summary: When a background session dispatches multiple concurrent subagents (via the Agent tool) that each call EnterWorktree for their own isolated git worktree, the isolation/cwd pointer appears to be a single shared value for the whole background job rather than scoped per-agent. Whichever sibling's isolation call lands last can silently redirect another sibling's — or even the parent coordinator's own — subsequent tool calls into the wrong worktree.

Reproduction context: One coordinating background session dispatched 3 sibling agents, each running EnterWorktree for its own ticket's worktree, working concurrently.

Observed symptoms (all in one session, over ~15 minutes):

1. Sibling A's ExitWorktree(action="keep") reported preserving sibling B's worktree path, not its own.
2. Sibling A's Write call was rejected with "This session is now isolated in <sibling C's worktree path>" — despite Sibling A never having called EnterWorktree/ExitWorktree again since creating its own worktree.
3. The parent coordinator's own Bash tool cwd was silently reset mid-turn to a sibling's worktree path — twice, including once immediately after the coordinator explicitly cd'd back to the primary checkout and got a clean readout on the same call.
4. Sibling B independently hit the same symptom on its Edit tool specifically (not Bash): two Edit calls to a file already inside its own worktree path got rejected, each naming a different wrong sibling worktree, back to back.

What did NOT happen: No confirmed data corruption. In every case checked, the rejection/redirect was loud (an error, or an unexpected-but-inspectable cwd), never a silent successful write into the wrong tree. Independent verification of all resulting PRs' diffs found no cross-contamination.

Workaround used: Strict serialization — only one sibling agent active (writing) at a time, others frozen; every state check chained an explicit cd <absolute-path> && pwd && git status in a single call rather than trusting a prior cwd.

Impact: Makes concurrent worktree-isolated subagent dispatch from a single background session unsafe without manual serialization. Silent success-into-wrong-tree seems possible in principle (only avoided here by luck/timing), which would be data loss with no error at all.