refactor(tooling): T-1286 — generate, pr and dev become reach domains

Twelve scripts retired, three domains registered. `reach` now covers nine.

generate: `generate-brands` and `generate-corporations` were the second and
third copies of the same 24-line build-if-missing-then-exec bash `tooling/atlas`
carried, so they collapsed into `core.process.cargo_binary` rather than being
ported. `import_economics` shelled out to the first of those, so it now calls
that helper — `generated_brands.toml` comes back byte-identical, and the stamp
registry swaps the retired wrapper for `core/process.py`.

pr: `watchlist-diff` derives its watched set from `generator_sources.py` instead
of restating it, so it cannot drift from the stamp check.

dev: the environment scripts split decision from performing, per D-263's
guarded-exec rule. `godot_plan()` and `worktree_plan()` decide what would
happen; `install_godot()`, `install_rust()` and `setup_worktree()` do it.
`tooling/test_environment.py` pins the version pin, both override precedences,
the already-current skip, the platform refusal and both worktree refusals —
none of them performed. `make setup` now installs reach first, since the
targets that install rust and godot are reach verbs.

Two live bugs found while porting:

- The clerk read its decision index from `decisions/README.md`, a path that
  stopped existing when the DQR tree moved to `governance/`. Every clerk agent
  has been grepping blind; its prompt pointed at the same dead directory.
- The conformance exec-check matched any `x.system()` regardless of receiver,
  so `platform.system()` read as `os.system()`. Narrowed and re-proved against
  a real mutant.

`process.run` gains `input=`, `timeout=` and a `ProcessTimeout` subclass so a
killed run stays distinguishable from a verdict. The pre-push hook no longer
merges the clerk's stderr into its stdout — under streaming the last merged
line is a JSONL event, which would read as an unrecognised verdict and block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tooling/domains/atlas/binary.py

@@ -11,15 +11,18 @@ what exists, and an index that says "ask the binary" is not one. The cost is
 that a subcommand added on the Rust side is invisible here until someone adds a
 line — so `run()` also accepts anything, and an unknown verb reaches the binary
 rather than being rejected by a list that has fallen behind.
+
+The build-if-missing and invoke machinery moved to `core.process.cargo_binary`
+once `generate-brands` and `generate-corporations` turned out to be the same
+24 lines of bash. Three copies of one idea is a substrate.
 """
 
 from __future__ import annotations
 
-from tooling.core import config, console, process
-from tooling.core.errors import ReachError
+from tooling.core import process
 
 # What the binary offers today. Discovered from the wrapper's own usage text and
-# from atlas-commit-and-sync, which calls three verbs the wrapper never
+# from atlas-commit-and-sync, which calls four verbs the wrapper never
 # documented — list-stations, wipe-system, commit-system, sync-wiki.
 KNOWN_VERBS = (
     "stats",
@@ -33,34 +36,6 @@ KNOWN_VERBS = (
 )
 
 
-def binary_path():
-    return config.path("server", "target", "debug", "atlas")
-
-
 def run(*args: str, capture: bool = True) -> str:
     """Invoke the Rust atlas binary, building it first if it is absent."""
-    binary = binary_path()
-    if not binary.is_file():
-        console.event("building the atlas binary (first run)", level="warn")
-        build = process.run(
-            ["cargo", "build", "--bin", "atlas"],
-            cwd=config.path("server"),
-            check=False,
-            missing_fix="install Rust — make setup-rust",
-        )
-        if build.returncode != 0:
-            raise ReachError(
-                f"could not build the atlas binary\n{(build.stderr or '').strip()}",
-                fix="cd server && cargo build --bin atlas — to see the full error",
-                exit_code=build.returncode,
-            )
-
-    result = process.run([str(binary), *args], check=False, capture=capture)
-    if result.returncode != 0:
-        raise ReachError(
-            f"atlas {' '.join(args)} exited {result.returncode}\n"
-            + (result.stderr or "").strip(),
-            fix=f"run `{binary} {' '.join(args)}` directly for the full output",
-            exit_code=result.returncode,
-        )
-    return result.stdout or ""
+    return process.cargo_binary("atlas", *args, capture=capture)