refactor(tooling): T-1286 — generate, pr and dev become reach domains

Twelve scripts retired, three domains registered. `reach` now covers nine.

generate: `generate-brands` and `generate-corporations` were the second and
third copies of the same 24-line build-if-missing-then-exec bash `tooling/atlas`
carried, so they collapsed into `core.process.cargo_binary` rather than being
ported. `import_economics` shelled out to the first of those, so it now calls
that helper — `generated_brands.toml` comes back byte-identical, and the stamp
registry swaps the retired wrapper for `core/process.py`.

pr: `watchlist-diff` derives its watched set from `generator_sources.py` instead
of restating it, so it cannot drift from the stamp check.

dev: the environment scripts split decision from performing, per D-263's
guarded-exec rule. `godot_plan()` and `worktree_plan()` decide what would
happen; `install_godot()`, `install_rust()` and `setup_worktree()` do it.
`tooling/test_environment.py` pins the version pin, both override precedences,
the already-current skip, the platform refusal and both worktree refusals —
none of them performed. `make setup` now installs reach first, since the
targets that install rust and godot are reach verbs.

Two live bugs found while porting:

- The clerk read its decision index from `decisions/README.md`, a path that
  stopped existing when the DQR tree moved to `governance/`. Every clerk agent
  has been grepping blind; its prompt pointed at the same dead directory.
- The conformance exec-check matched any `x.system()` regardless of receiver,
  so `platform.system()` read as `os.system()`. Narrowed and re-proved against
  a real mutant.

`process.run` gains `input=`, `timeout=` and a `ProcessTimeout` subclass so a
killed run stays distinguishable from a verdict. The pre-push hook no longer
merges the clerk's stderr into its stdout — under streaming the last merged
line is a JSONL event, which would read as an unrecognised verdict and block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tooling/generator_sources.py

@@ -50,8 +50,8 @@ ECONOMY_IMPORT_PACKAGE_DIR: Path = (
     REPO_ROOT / "tooling" / "economy-db" / "economy_import"
 )
 
-# Rust sources for the generate_brands subroutine.  import_economics shells out
-# to tooling/generate-brands as part of its normal flow (see economy_import/
+# Rust sources for the generate_brands subroutine.  import_economics runs the
+# generate_brands binary as part of its normal flow (see economy_import/
 # brands.py), so all of these contribute to its effective source SHA: any change
 # to them must invalidate the meta stamp even though Python hasn't changed.
 GENERATE_BRANDS_RS: Path = (
@@ -64,7 +64,11 @@ GENERATE_BRANDS_NAMES_RS: Path = (
 GENERATE_BRANDS_SURNAMES_RS: Path = (
     REPO_ROOT / "server" / "src" / "bin" / "shared" / "surname_corpus.rs"
 )
-GENERATE_BRANDS_WRAPPER: Path = REPO_ROOT / "tooling" / "generate-brands"
+# The `tooling/generate-brands` bash wrapper used to be stamped here. It was one
+# of three identical copies of build-if-missing-then-exec and was retired into
+# core.process.cargo_binary (T-1286); the seed argument it carried now lives in
+# economy_import/brands.py, which is already stamped via the package directory
+# below. Nothing about the brand output stopped being covered.
 
 # D-237 authored specialization layer: these data TOMLs feed the DB, so a change
 # to either must flip the stamp and force a regen (#1013).
@@ -170,7 +174,7 @@ IMPORT_ECONOMICS_SOURCES: tuple[Path, ...] = (
     GENERATE_BRANDS_RS,
     GENERATE_BRANDS_NAMES_RS,
     GENERATE_BRANDS_SURNAMES_RS,
-    GENERATE_BRANDS_WRAPPER,
+    REPO_ROOT / "tooling" / "core" / "process.py",  # runs the brand binary (T-1286)
     REPO_ROOT / "tooling" / "schema_version.py",
     SPECIALIZATION_VOCAB_TOML,
     SYSTEM_SPECIALIZATION_TOML,