fix: reconcile audit-cleanup refactor with @boocode/contracts SSOT (worktree-risk type, frame-emitter import)

worktree-risk.ts now returns the package's WorktreeRiskReport (local RiskReport interface removed); frame-emitter.ts imports WsFrame from @boocode/contracts/ws-frames (the deleted @boocode/server/ws-frames subpath).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/coder/src/services/frame-emitter.ts

@@ -17,7 +17,7 @@
  * but never publishes.
  */
 import type { Broker } from '@boocode/server/broker';
-import type { WsFrame } from '@boocode/server/ws-frames';
+import type { WsFrame } from '@boocode/contracts/ws-frames';
 import type { AgentEvent } from './agent-backend.js';
 import { type AcpToolSnapshot, snapshotToWireToolCall } from './acp-tool-snapshot.js';
 import { mergeTaskCommands, getTaskCommands } from './agent-commands-cache.js';

apps/coder/src/services/worktree-risk.ts

@@ -9,24 +9,9 @@
  * server calls the routes that wrap these helpers. Behavior is unchanged from the
  * original worktrees.ts implementation.
  */
+import type { WorktreeRiskReport } from '@boocode/contracts/worktree-risk';
 import { hostExec } from './host-exec.js';
 
-/**
- * Risk report for a single worktree, returned by checkWorktreeWorkAtRisk.
- * `atRisk` is the gate the server reads before allowing a session delete.
- * A git error never silently passes — it forces `atRisk` true and surfaces
- * the message in `error` (fail-closed).
- */
-export interface RiskReport {
-  worktreePath: string;
-  branch: string;
-  dirty: boolean;   // uncommitted working-tree changes (incl. untracked)
-  unpushed: number; // commits ahead of upstream, or -1 if no upstream is set
-  unmerged: number; // commits on this branch not in the project default branch
-  atRisk: boolean;  // dirty || unmerged > 0 || (upstream && unpushed > 0) || git error
-  error?: string;   // populated on a git failure; presence forces atRisk
-}
-
 /**
  * Resolve the project's default branch as a git-usable ref (e.g. "origin/main").
  *
@@ -79,7 +64,7 @@ async function detectDefaultBranchRef(
 export async function checkWorktreeWorkAtRisk(
   worktreePath: string,
   opts?: { signal?: AbortSignal },
-): Promise<RiskReport> {
+): Promise<WorktreeRiskReport> {
   // Branch name — also doubles as the "is this still a git worktree?" probe.
   const br = await hostExec(
     `git -C ${shellEscape(worktreePath)} rev-parse --abbrev-ref HEAD`,