…gine

The reference implementation had drifted well behind the working tool. Brings
across the engine improvements, keeping the same shape: a CONFIG block of pure
data and a stack-agnostic engine that hardcodes no role, port, or path.

New surface:
- deps: declare a dep dir per role (node_modules, .venv) and the command that
  builds it. A worktree is only a checkout, so without this a fresh member
  starts and immediately dies. new/add now seed config and build deps, leaving
  a runnable tree; --no-env/--no-deps opt out.
- bind: creating a group from the current tree is now explicit. A bare
  `wtg <name>` binds only into an existing group, so a typo such as
  `wtg downfoo` can no longer create a group, rebind the tree away from its
  real one, and overwrite its dev.sh.
- --base <ref>: per-run start point. Repos are fetched first and a bare name
  resolves to origin/<name>, so a worktree is cut from the latest remote tip
  rather than a stale local branch.
- st: one table carrying branch, clean/DIRTY, upstream, commits behind base,
  port, config and dep state, followed by a warnings block that prints the
  exact command to fix each problem. --fetch refreshes first.
- up/down: members launch in their own process group and down kills the group.
  Killing only the recorded pid left the pnpm->vite and uvicorn-reloader
  children alive holding the ports, so every later up died with EADDRINUSE
  while orphans kept serving stale code.
- WTG_WORKDIR, WTG_LAUNCHER_ARGS, WTG_OAUTH_ROLES, and WTG_API_ROLE split from
  WTG_PRIMARY_ROLE, since the backend a frontend calls is not always the tree
  the agent opens in nor the one holding the OAuth redirect.

Seeded config is written with install -m 600 rather than cp. These files carry
live secrets and cp takes the caller's umask, which on a common 0002 leaves
them world-readable at 0644.

Defaults stay tool-agnostic: XDG paths, a generic api/web example, and no
launcher arguments.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>