merge: refuse a kill when the worktree holds unsaved work

Collapses the two probes #79 and #80 grew in parallel into one:
worktree_probe::in_the_way is the single predicate behind the kill
refusal, the retained list, and the natural-exit classifier to come.
Keeps #79's in-worktree resolution (detached HEAD, missing directory)
and #80's InTheWay payload, and drops the duplicate UnsavedWork type.

Closes #79

crates/maestro-protocol/src/lib.rs

@@ -195,6 +195,35 @@ pub struct RetainedWorktree {
     pub in_the_way: InTheWay,
 }
 
+impl std::fmt::Display for InTheWay {
+    /// "3 uncommitted files, 2 unpushed commits" — zero parts are omitted;
+    /// all-zero renders "no unsaved work". This is the phrasing every client
+    /// uses for both the kill refusal and the retained list, so the two
+    /// cannot describe the same tree differently.
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let parts = [
+            (self.uncommitted_files, "uncommitted file"),
+            (self.untracked_files, "untracked file"),
+            (self.unpushed_commits, "unpushed commit"),
+        ];
+        let said: Vec<String> = parts
+            .into_iter()
+            .filter(|(n, _)| *n > 0)
+            .map(|(n, unit)| {
+                if n == 1 {
+                    format!("1 {unit}")
+                } else {
+                    format!("{n} {unit}s")
+                }
+            })
+            .collect();
+        if said.is_empty() {
+            return write!(f, "no unsaved work");
+        }
+        write!(f, "{}", said.join(", "))
+    }
+}
+
 /// HTTP `POST /api/sessions` body.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct CreateSessionRequest {
@@ -300,6 +329,10 @@ pub struct BranchInfo {
 pub struct ErrorInfo {
     pub code: String,
     pub message: String,
+    /// Set only by the kill guard (#79): the unsaved work that blocked
+    /// `DELETE /api/sessions/:id`, so a client can render counts directly.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub unsaved_work: Option<InTheWay>,
 }
 
 /// The envelope every `/api/*` failure is wrapped in: `{"error": {…}}`.
@@ -320,6 +353,7 @@ impl ApiError {
             error: ErrorInfo {
                 code: code.into(),
                 message: message.into(),
+                unsaved_work: None,
             },
         }
     }
@@ -684,6 +718,7 @@ mod tests {
             ClientControl::Error(ErrorInfo {
                 code: "bad_frame".into(),
                 message: "decode failed".into(),
+                unsaved_work: None,
             }),
             resize,
         ] {