FE-883: Cook run worktree/branch GC

[kostandinang]

Stacks on #230 (FE-883 slice 1). Replaces the operator-owned git worktree remove / git branch -D cleanup that worktree.ts documented, and retires the dead code slice 1 orphaned.

Worktree/branch GC (slice 2)

gcCookRun reclaims a finished run's transient state: removes every worktree registered under the run dir (run worktree + nested slice/__epic__ worktrees, deepest-first), deletes the intermediate brunch/slice/<runId>/* branches (their work is folded into the run branch), and removes the on-disk run dir — while keeping the brunch/run/<runId> artifact branch the user reviews/merges, and every other run untouched. Best-effort + idempotent; realpath-safe so it matches git's worktree-list paths (macOS /var→/private/var).

Wired into cook-cli: auto-GC on a completed + promoted brownfield run, best-effort (never fails a good run). Halted/conflicted runs return earlier and keep their worktrees for inspection (keep-on-failure). No flag — no leaks by default.

Retire dead promoteBrownfieldRun (1d)

Slice 1 replaced the brownfield promotion path with harvestCookRun's merge-tree fold, leaving promoteBrownfieldRun (file-copy commit-tree) used only by its own tests. Deleted it + BrownfieldPromoteOptions + its test block, cleaned the now-unused imports, and rebuilt the landCookBranch test fixture (it had used promoteBrownfieldRun to construct a promoted branch) with a plain commit on brunch/run/r1. mergeSlicesIntoEpicSandbox and promoteGreenfieldRun stay (the greenfield path).

Tests

run-refs.test.ts (GC keeps the run branch; unrelated runs untouched), promote-run.test.ts (rewired fixture). Full orchestrator suite green (677).

Remaining

A multi-slice end-to-end runCook test of the promotion + GC wiring — the merge logic is unit-tested (run-artifact.test.ts) and the 1-slice brownfield-smoke exercises the engine path, so this is the one coverage gap. Tracked in memory/CARDS.md.

[cursor]

PR Summary

Medium Risk
Runs destructive git worktree/branch and filesystem cleanup on the user repo, though scoped to the run directory, best-effort, and skipped when promotion fails; incorrect path matching could affect unrelated worktrees.

Overview
Adds gcCookRun in run-refs.ts to reclaim a finished run’s transient git state: nested worktrees under the run dir (deepest-first), intermediate brunch/slice/<runId>/* branches, and the on-disk .brunch/cook/runs/<id> tree, while preserving brunch/run/<runId> and other runs. Path matching is realpath-safe for macOS.

cook-cli invokes gcCookRun automatically after a completed, successfully promoted brownfield run (wrapped in try/catch so cleanup never fails the run). Halted or conflicted runs exit earlier and keep worktrees for inspection.

Removes the unused promoteBrownfieldRun path (superseded by harvestCookRun), its types/imports, and the dedicated test block; landCookBranch tests now seed a promoted branch via a throwaway worktree commit. memory/CARDS.md marks FE-883 Slice 2 (worktree/branch GC) as done.

^{Reviewed by Cursor Bugbot for commit 593032a. Bugbot is set up for automated code reviews on this repo. Configure here.}