feat(worktree): declare the post-create hook command outside the repo

[obogoni]

Summary

The post-create hook command can now be declared outside the repo it initializes.

AD-013 put it inside: <repo>\.app\config.json, key postCreateCommand. For a shared team repo that
is a dead end — either a permanent ?? .app/ in git status, or a PR into the team repo just to
record one developer's local automation. This PR adds a second declaration site in the workspace file
that already exists and is already hand-authored for branchTemplate/worktreeTemplate:

// M:\Triade\source\.app\config.json  — one workspace, many repos
{
  "postCreateCommands": {
    "Code": ".\\SetupSkills.cmd < NUL"
  }
}

AD-013 is extended, not reversed. The repo still wins; the workspace entry is only the fallback,
so WPC-01/WPC-06 keep holding verbatim and every pre-existing test passes unmodified. Exactly one
command runs per create — never both levels. Per-repo keys only: no "*" default and no bare
workspace-level string, so a newly cloned repo runs nothing until it is named.

Nothing about how the command runs changes — cwd, the PLAYGROUND_* env, the 120 s timeout, the
4000-char output tail, the run-iff-created rule and the keep-the-worktree-on-failure semantics are all
untouched. This PR changes only where the string comes from.

Decision record: AD-015 in .specs/STATE.md. Spec + validation:
.specs/features/worktree-hook-workspace-config/.

Closes #74

Changes

• repo-config.ts — new workspacePostCreateCommand(workspaceDir, repoName) reader, plus a
  resolvePostCreateCommand(repoPath) composer that wraps the two readers repo-first,
  workspace-second. Key matching is exact first, then a unique case-insensitive match (Windows
  folder names are case-insensitive, AD-005); two-or-more case-insensitive matches with no exact
  match resolve to no command plus one log rather than an arbitrary winner.
• post-create-hook.ts wiring — resolvePostCreateCommand becomes withPostCreateHook's
  readCommand. readCommand's signature is unchanged, because scanRepos is a single-level
  scan (repo-scanner.ts:20-38) — a repo is always a direct child of its workspace — so the
  workspace is dirname(repoPath) and the key is basename(repoPath), derived purely lexically
  with no lookup against AppConfig.workspaces. worktree-manager.ts and workflow-ctx.ts are
  untouched.
• README.md — documents both declaration sites, the repo-wins precedence, and the accepted
  untrusted-repo-content risk (which shrinks at workspace level, since you author that file
  yourself).
• .specs/ — AD-015, the HWC-01..14 spec, and the validation report.
• Carries one commit from the removal branch, 5e22450 (docs(specs): correct the lessons-store
  note), which was made after PR Worktree removal fault tolerance: delete first, deregister second #73 merged and so never reached main. This branch was originally
  cut off the removal branch; by the time it was ready, Worktree removal fault tolerance: delete first, deregister second #73 had merged, so it targets main directly
  rather than stacking.

Testing

• Manual test
• Automated tests added/updated

605 tests passing, typecheck clean, lint 0 errors / 18 pre-existing warnings.

All 14 ACs (HWC-01..14) Verified by a standalone fresh-eyes pass with a discrimination sensor —
9/12 mutants killed; the 3 survivors are recorded equivalence artifacts. Note author ≠ verifier is
unmet (this harness is configured without Verifier sub-agents), so the sensor is the compensating
control rather than a second opinion.

End-to-end, on the real repo: a worktree create for M:\Triade\source\Code from the New Worktree
dialog, driven over CDP against the dev app, with M:\Triade\source\.app\config.json as the only
source of the command (M:\Triade\source\Code\.app\config.json is deleted). Create completed with no
hook-failure advisory, the dialog closed and selected the new worktree, and both .claude\skills and
.codex\skills landed as reparse points into that worktree's own .github\skills (14 entries each).
The throwaway worktree was then removed delete-first per AD-014. Full run in validation.md.

Screenshots / Notes

One pre-existing test failure is expected on this machine and is not a regression. On Node
v24.9.0 here, every fs.rmSync shape silently no-ops when any path component contains a non-ASCII
character; the fixtures root at realpathSync.native(tmpdir()) = C:\Users\OtávioBogoni\…, so
worktree-manager.test.ts > removeWorktree > force-removes a worktree with mixed dirt fails on a
clean tree. No production file uses rmSync (dir-remover.ts uses async rm, re-measured correct on
non-ASCII trees). CI runs on windows-latest under a different profile name and is unaffected.

Follow-ups, not part of this PR: the removal feature's live smoke (scripts/smoke-remove.mjs) and
the Danger-section visual pass are still open against already-merged code (WRFT-06); WRFT-07
(create-time leftover collision) is specified and deferred.

Checklist

• Self-reviewed the diff
• No secrets or credentials committed
• Related issues linked (Closes #74)