feat(clone): add wt clone with repo_root + repo_pattern placement

[timvw]

Adapts @brosu's wt clone from #122 (their commits are preserved here) to a smaller configuration surface.

What changed vs #122

#122 introduced a category tier: a [categories.*] registry with built-in work/personal/oss, each carrying a repo_root and an auth profile (gh_auth, git_protocol, glab_host), plus a default_category. This drops that tier and keeps two flat settings:

repo_root    = "~/dev/repos"
repo_pattern = "{.repoRoot}/{.repo.Host}/{.repo.Owner}/{.repo.Name}/{.branch}"

wt clone timvw/wt → ~/dev/repos/github.com/timvw/wt/main.

Grouping is no longer a concept wt owns. Patterns already support {.env.VARNAME}, so anyone who wants categories writes one:

repo_pattern = "{.repoRoot}/{.env.WT_CATEGORY}/{.repo.Owner}/{.repo.Name}/{.branch}"

WT_CATEGORY=work wt clone acme/api   # ~/dev/repos/work/acme/api/main

That covers category, client, year, or any other axis, without wt picking the vocabulary — and it composes with the worktree pattern mechanism users already know.

Auth follows the same principle. #122 called gh auth switch per category; that mutates gh's global hosts.yml and silently flips the active account for every other process on the machine, including ones the user did not run. Account selection stays with the tools that own it (GH_CONFIG_DIR, GH_TOKEN, GLAB_HOST), and each of gh/glab is now asked for its own git_protocol instead of gh deciding for both.

Fixes on top of the original implementation

• Relative patterns: a repo_pattern without {.repoRoot} cloned into the caller's current directory. Now anchored under repo_root, matching how renderWorktreePath anchors relative worktree patterns.
• Path traversal: .. in the rendered host, owner, repo name or branch is rejected. wt clone https://host/../../tmp/pwn.git — or an scp-like ../escape:owner/repo.git, where the traversal is the host — placed the clone outside repo_root. A pasted URL is untrusted input.
• Argument injection: -- before the URL in git clone and git ls-remote, so a source starting with - cannot be read as an option.
• Clone hook env: WT_MAIN and WT_BRANCH were both empty. The clone is its own main worktree, and the default branch is now resolved once up front and shared by placement and the hook env.
• Repo-level config: repo_root, repo_pattern and the clone hooks are not read from a repo's .wt.toml. wt clone acquires a repository unrelated to the one you are standing in, so that repo's config must not redirect the destination or run hooks — mirroring the existing exclusion of root.
• Path anchoring: keyed on whether the pattern names {.repoRoot} rather than on filepath.IsAbs. A relative repo_root, or a rooted-but-driveless Windows one (\data\repos), is not IsAbs, so the root was being prepended a second time.
• Local paths with a colon: parseRemoteURL read any string containing : as scp-like, so on Windows wt clone C:/src/repo parsed host C, owner Users/... and placed the clone at <repo_root>/C/Users/.../repo/main instead of reporting it cannot derive a placement. Now follows git's rules — the colon must precede any slash, and a single character before it is a drive letter. Real remotes are unaffected.
• config show sizes its value column to its contents, so the long default repo_pattern keeps its source marker aligned.

Why the trailing {.branch}

The clone lands at <repo>/<default-branch> rather than <repo>. That makes it a normal worktree slot, so a later wt create feat/x puts a sibling next to it instead of nesting inside the clone. Users who prefer a bare <owner>/<repo> checkout drop the segment from the pattern.

Testing

• go test ./..., go vet ./..., gofmt clean
• e2e green on bash + zsh (clone and hooks scenarios; new clone_hook_env_has_branch verifies WT_BRANCH, and it fails if the variable is empty)
• New unit tests for placement, the relative-pattern anchor, the {.env.X} grouping mechanism, and the traversal guard
• One pre-existing e2e failure (config/config_show_defaults) reproduces on main with an unmodified binary and is unrelated

Closes #122.

[codecov]

Codecov Report

❌ Patch coverage is 37.09677% with 156 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.10%. Comparing base (2867d8d) to head (258fc57).

Files with missing lines	Patch %	Lines
cmd/clone.go	9.25%	98 Missing ⚠️
internal/tmpl/tmpl.go	0.00%	23 Missing ⚠️
cmd/clone_path.go	65.11%	13 Missing and 2 partials ⚠️
cmd/info.go	0.00%	13 Missing ⚠️
cmd/config.go	70.00%	4 Missing and 2 partials ⚠️
cmd/shellenv.go	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #127      +/-   ##
==========================================
- Coverage   37.53%   37.10%   -0.43%     
==========================================
  Files          30       33       +3     
  Lines        3229     3444     +215     
==========================================
+ Hits         1212     1278      +66     
- Misses       1928     2073     +145     
- Partials       89       93       +4     

Files with missing lines	Coverage Δ
cmd/config_cmd.go	65.62% <100.00%> (+7.13%)	⬆️
cmd/examples.go	67.74% <ø> (ø)
cmd/hooks.go	89.74% <100.00%> (+0.55%)	⬆️
cmd/repo.go	65.97% <100.00%> (+1.81%)	⬆️
cmd/root.go	70.78% <100.00%> (+0.33%)	⬆️
cmd/worktree_path.go	56.00% <100.00%> (-2.54%)	⬇️
cmd/shellenv.go	79.05% <83.33%> (+0.23%)	⬆️
cmd/config.go	69.93% <70.00%> (-0.87%)	⬇️
cmd/info.go	0.00% <0.00%> (ø)
cmd/clone_path.go	65.11% <65.11%> (ø)
... and 2 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.