Make branch delete's dependency check manifest-only per surviving branch

[ragnorc]

What & why

branch_delete proves no surviving branch still references the deleted branch's per-table forks, but its per-branch check performed a full cold target resolve — a manifest state scan plus a commit-lineage scan plus a schema-contract re-read/re-validate per foreign branch — making deletion O(branches × history) on un-compacted graphs and timing out on large ones. This switches the loop to the existing manifest-only per-branch snapshot (the same shape cleanup uses), halving the per-surviving-branch __manifest cost from 2 reads/opens to 1 and dropping the per-branch contract reads and schema recompiles entirely.

Backing issue / RFC

• Fixes an accepted issue: Closes #
• Implements / is an accepted RFC:
• Trivial fast-lane — no issue/RFC required

Maintainer perf fix from a branch-operation cost audit; no pre-existing accepted issue.

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes — new branch_control_cost.rs slope gate on the shared cost harness, landed red (2 reads/opens per surviving branch) one commit before the fix turns it green (1 per branch)
• Public docs updated if user-facing surface changed — docs/dev/testing.md row for the new cost test; no user-facing surface change
• Reviewed against docs/dev/invariants.md — no invariant weakened; this closes a cold re-derivation cost on a control path

Notes for reviewers

The dropped per-foreign-branch schema validation was incidental coupling: it could wedge deletion of an unrelated branch behind another branch's schema drift, while the deleting operation's own schema is still validated under the schema gate. The dependency loop itself is defense-in-depth (created-from lineage is already refused by the earlier descendant check and by the ref layer), and its predicate and refusal messages are unchanged.

---

Note

Medium Risk
Touches branch control and removes incidental per-foreign-branch schema validation; behavior for the dependency predicate is intended to be identical, but large-graph delete paths are sensitive and the change is covered mainly by a cost regression test rather than new functional cases.

Overview
branch_delete no longer times out on graphs with many branches or deep history when proving no other branch still references the victim’s per-table forks.

The loop over surviving branches now calls fresh_snapshot_for_branch_unchecked (manifest state only, same shape as cleanup) instead of snapshot_of, which pulled commit lineage and re-read/re-validated the schema contract per foreign branch. Dependency detection still scans each snapshot’s manifest table_branch entries; conflict messages and predicates are unchanged. The deleting operation’s schema remains validated under the existing schema gate, so the dropped per-branch schema checks were redundant work—and could block deleting one branch when another branch had schema drift.

Adds branch_control_cost.rs with a slope gate on __manifest reads/opens per surviving branch (1 per branch, not 2), and documents the test in docs/dev/testing.md.

^{Reviewed by Cursor Bugbot for commit ad6c609. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR makes branch deletion inspect only each surviving branch’s manifest. The main changes are:

• Replaces full branch resolution with a manifest-only snapshot.
• Adds a cost-slope test for manifest reads and opens.
• Documents the new branch-control cost coverage.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
crates/omnigraph/src/db/omnigraph.rs	Uses a fresh manifest-only snapshot for each surviving branch without changing the dependency predicate.
crates/omnigraph/tests/branch_control_cost.rs	Adds a two-point cost test that bounds incremental manifest reads and internal opens.
docs/dev/testing.md	Adds the branch-control cost test to the developer coverage map.

_{Reviews (1): Last reviewed commit: "Read manifest-only snapshots in branch d..." | Re-trigger Greptile}

Context used:

• Context used - AGENTS.md (source)
• Context used - CLAUDE.md (source)

[aaltshuler]

Closing this PR as stale against the current write path.

Since this branch was cut, the B1 work changed branch-delete admission, recovery, lifecycle fencing, gate ownership, and operation-local capture. The PR's slope test now passes on current main without its production change, while a direct rebase adds a cold main manifest open/scan and fails the existing branch-control cost budget. The manifest-only loop also drops per-survivor catalog validation and still performs one history-sensitive manifest scan per surviving branch, so the stated complexity result is not established.

The underlying idea may be revisited as a current-main fast-lane optimization after measuring the remaining schema/lineage cost, preserving catalog validation, and avoiding the extra main scan.