refactor(tooling): T-1286 — generate, pr and dev become reach domains

Twelve scripts retired, three domains registered. `reach` now covers nine.

generate: `generate-brands` and `generate-corporations` were the second and
third copies of the same 24-line build-if-missing-then-exec bash `tooling/atlas`
carried, so they collapsed into `core.process.cargo_binary` rather than being
ported. `import_economics` shelled out to the first of those, so it now calls
that helper — `generated_brands.toml` comes back byte-identical, and the stamp
registry swaps the retired wrapper for `core/process.py`.

pr: `watchlist-diff` derives its watched set from `generator_sources.py` instead
of restating it, so it cannot drift from the stamp check.

dev: the environment scripts split decision from performing, per D-263's
guarded-exec rule. `godot_plan()` and `worktree_plan()` decide what would
happen; `install_godot()`, `install_rust()` and `setup_worktree()` do it.
`tooling/test_environment.py` pins the version pin, both override precedences,
the already-current skip, the platform refusal and both worktree refusals —
none of them performed. `make setup` now installs reach first, since the
targets that install rust and godot are reach verbs.

Two live bugs found while porting:

- The clerk read its decision index from `decisions/README.md`, a path that
  stopped existing when the DQR tree moved to `governance/`. Every clerk agent
  has been grepping blind; its prompt pointed at the same dead directory.
- The conformance exec-check matched any `x.system()` regardless of receiver,
  so `platform.system()` read as `os.system()`. Narrowed and re-proved against
  a real mutant.

`process.run` gains `input=`, `timeout=` and a `ProcessTimeout` subclass so a
killed run stays distinguishable from a verdict. The pre-push hook no longer
merges the clerk's stderr into its stdout — under streaming the last merged
line is a JSONL event, which would read as an unrecognised verdict and block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -89,14 +89,17 @@ help:
 
 # --- Setup ---
 
-setup: setup-rust setup-godot setup-tooling setup-venv install-reach setup-hooks decisions-sync
+# install-reach leads: it needs only uv, and setup-rust/setup-godot are now
+# reach verbs. Bootstrapping the CLI before the things it installs is the only
+# order that works on a cold checkout.
+setup: install-reach setup-rust setup-godot setup-tooling setup-venv setup-hooks decisions-sync
 	@echo "Dev environment ready."
 
 setup-rust:
-	@tooling/install-rust
+	@reach dev install-rust
 
 setup-godot:
-	@GODOT_VERSION=$(GODOT_VERSION) tooling/install-godot
+	@reach dev install-godot --version $(GODOT_VERSION)
 
 setup-tooling:
 	@echo "Checking tooling dependencies..."
@@ -307,6 +310,10 @@ test-tooling:
 	@mkdir -p .cache
 	@$(VENV_PY) tooling/test_jobs.py 2> .cache/test-tooling-jobs.log || \
 		{ echo "  FAIL: jobs service — log follows:"; cat .cache/test-tooling-jobs.log; exit 1; }
+	@echo "  [test-tooling] reach dev environment decisions (T-1286)..."
+	@mkdir -p .cache
+	@$(VENV_PY) tooling/test_environment.py 2> .cache/test-tooling-environment.log || \
+		{ echo "  FAIL: environment decisions — log follows:"; cat .cache/test-tooling-environment.log; exit 1; }
 	@echo "  [test-tooling] reach D-263 conformance (T-1270)..."
 	@mkdir -p .cache
 	@$(VENV_PY) tooling/test_conformance.py 2> .cache/test-tooling-conformance.log || \
@@ -438,7 +445,7 @@ ci-client: lint-client build-client test-client
 
 economy-db:  ## Import economics data (commodities, chains, gate links) into systems.db
 	@echo "  Generating minor brands (D-189 #829)..."
-	@tooling/generate-brands
+	@reach generate brands
 	@python3 tooling/economy-db/import_economics.py
 
 regen-db:  ## Regenerate systems.db from all sources and stamp meta table (#855, #856)
@@ -523,7 +530,7 @@ star-map-data:
 	@python3 tooling/generate-star-map-data.py
 
 perf-baseline:
-	@tooling/perf-baseline
+	@reach dev perf
 
 # --- Schedule debug (#346) ---
 
@@ -579,7 +586,7 @@ test-voice-real:
 # --- Asset manifest ---
 
 manifest:
-	@tooling/generate-character-manifest
+	@reach generate character-manifest
 	@echo "Manifest regenerated — commit client/assets/characters/manifest.json if changed."
 
 # --- Diagrams ---