feat: admit existing OpenBao catalog lanes

tests/test_safe_paths.py

@@ -0,0 +1,21 @@
+from secrets_engine.safe_paths import containing_git_worktree
+
+
+def test_empty_git_named_directory_is_not_a_worktree(tmp_path):
+    (tmp_path / ".git").mkdir()
+    assert containing_git_worktree(tmp_path / "secret-file") is None
+
+
+def test_git_directory_with_head_is_a_worktree(tmp_path):
+    repo = tmp_path / "repo"
+    marker = repo / ".git"
+    marker.mkdir(parents=True)
+    (marker / "HEAD").write_text("ref: refs/heads/main\n", encoding="utf-8")
+    assert containing_git_worktree(repo / "secret-file") == repo
+
+
+def test_git_file_marks_linked_worktree(tmp_path):
+    repo = tmp_path / "linked"
+    repo.mkdir()
+    (repo / ".git").write_text("gitdir: /outside/worktrees/linked\n", encoding="utf-8")
+    assert containing_git_worktree(repo / "secret-file") == repo