Audit fixes: empty-dir handling, recursive scan, weave clean, hardened lock and hooks

[PurpleReverie]

Summary

Bug audit pass triggered by the empty-child-dir hang on first init. Found and fixed several adjacent issues along the way. Single commit, fully tested end-to-end against real git repos.

Bug fixes

• Empty placeholder dir on first init. When the target dir exists but has no `.git`, simple-git was walking up and running against the parent repo, so the child got reported as having "uncommitted-changes" (really the parent's). Now: empty dir → remove and clone; non-empty non-git dir → abort with a clear message so user data isn't wiped. Same guard added to `checkDirtyState` and `checkRepo`.
• First clone landed on the remote's default branch instead of `thread.branch`. Pass `--branch` on clone so the child starts on the requested branch; later `checkout(hash)` for pinned threads still works because all refs are fetched.
• `scan: ["."]` didn't find `.thread` files in subdirectories. Scan now recurses, skipping `.git`, `node_modules`, and any nested git repo (those are handled by `syncNestedThreads`). Results deduped by file path. README's documented `services/api.thread` layout now works with default config.

New: `weave clean`

Removes cloned child directories whose `.thread` file no longer exists.

• Default: dry run, reports each orphan's status (clean / dirty / unpushed / non-git / missing) and what would happen.
• `--apply`: actually remove clean orphans; refuse dirty/unpushed/non-git ones.
• `--force`: remove even dirty/unpushed/non-git orphans (implies `--apply`).
• Rebuilds the exclude block afterward to drop stale entries.

Ergonomic guards

• `weave lock` refuses to pin unpushed commits. Uses `git branch -r --contains ` to verify the commit is reachable from a remote branch; otherwise coworkers can't sync. `--force` overrides.
• `post-checkout` hook only fires on branch checkouts. Guards on `$3 = 1`; `git checkout README.md` no longer triggers `weave sync`.
• `weave init` no longer exits silently when nothing is found. Names the scan paths and shows an example.

Cleanup

• Consolidated four copies of `targetDirForThread` into `src/sync/targetDir.ts`. The previous `lastIndexOf('/')` implementation broke on Windows backslash paths; the shared helper uses `path.dirname`.

Test plan

End-to-end tests live at `tests/init-scenarios.sh` — no test framework, just bash + git + a local bare repo. 46 assertions across 17 scenarios.

• `./tests/init-scenarios.sh` passes locally (46/46)
• Reviewer: run `./tests/init-scenarios.sh` locally
• Reviewer: manual sanity check on a real multi-repo setup if you have one handy

Deliberately out of scope

These came up in the brainstorm but weren't touched — call-out so they don't get lost:

• `weave unlock` substring matching (behavior change risk)
• Single-thread targeting / dry-run for sync / parallel pre-push (features, not bugs)
• Detached-HEAD-after-unpin work-loss warning (UX needs care)
• Tag-as-branch, submodule init, git LFS, upstream rename detection (feature surface)
• Concurrent run locking, encoding handling, `.env` precedence, HTTPS prompt timeouts (orthogonal)