fix(worktree): correct the rationale the removal probes carry

The join was justified with a project sitting at a filesystem root, but
that project cannot have a worktree at all: `basename` is empty there, so
the generated name starts with a dash and `git worktree add` reads it as
options. State what the join actually buys — the removal and its own
probe agreeing on one directory — and say plainly that it does not make a
relative folder path coherent, because the engine's gates still read that
path from the app's working directory.

Map `AlreadyExists` too, which POSIX allows `rmdir` to return for a
non-empty directory, so replacing `AppCommandError::io` costs only its
message. Stop the probe fixture from claiming a guarantee it cannot give
about repositories above the system temp directory.