docs: file and plan itd-148, the worktree-first change discipline

[REPPL]

What

Files itd-148 (planned, severity major) with its spec spc-42, and appends the graded itd-84 hand-run to the decomposition-calibration note.

The intent: the primary checkout of an abcd-managed repo becomes a read-only surface with an explicit allow-set; every change starts in its own worktree, enforced by a host-hook backed by abcd worktree check plus a git pre-commit backstop; provably merged worktrees (remote PR state or patch-equivalence, never bare sha reachability) are removed at session start; abandoned worktrees (14 days idle, configurable) surface with a dirty-state-first dossier and recommendation, removed only on per-item human confirmation; worktrees are seeded with the private name-guard layer on detection (closing the iss-370 gap when built), with a four-category pre-population floor; worktree entry/exit and record-id mints are recorded for peer visibility at next hook fire.

Decomposition (itd-84, SPLIT confirmed)

• Merged-residue mechanics stay with itd-118 (consumed via builds_on).
• The coordination mechanism stays with itd-33; this intent carries only the record-then-inject visibility duty and adds none of what itd-33 cut.
• adr-45's timestamp-migration schedule is unchanged; mint visibility is the bridge.
• Bundled for resolution when the work ships: iss-370, iss-213, iss-2608230847432285, iss-2608230957104179, iss-2608210738378295.

Process

Decomposed against the existing record, revised under two independent adversarial reviews (design/feasibility and record-discipline — both caught the inverted squash-merge/reachability claim, now fixed), and planned at a live maintainer interview where every acceptance criterion and open question was ruled. abcd intent ready itd-148 passes all four checks; record-lint exits 0.

Assisted-by: Claude:claude-fable-5