refactor: address clawpatch findings

[Jercik]

Summary

Remediates the open clawpatch maintainability/perf findings and refreshes dev dependencies. Each finding was fixed with a focused manual change and committed as a verified batch.

One perf finding — making start skip the rebuild — was reverted after review. bin/worktree-add imports ../dist/cli.js, which is gitignored and absent in a clean checkout, so dropping the rebuild made pnpm start fail with ERR_MODULE_NOT_FOUND and could run stale dist/ output. start keeps running pnpm run rebuild && node bin/worktree-add, so this PR no longer touches that script.

Findings addressed

• CLI help reuses package metadata — src/cli.ts .description() now reads packageJson.description instead of a duplicated string.
• Relocated a misplaced test — the globToRegExp tests moved from src/cli.test.ts to src/worktree/file-patterns.test.ts, next to the module they exercise.
• Removed the get-status-logger wrapper — the one-line resolver is gone; call sites default inline with options.logger ?? fallbackStatusLogger.
• App opening surfaces unexpected failures — Promise.allSettled → Promise.all, keeping only the narrow try/catch around open(); dropped the test that enshrined the broad swallow. Realistic app-launch failures are still caught inline and logged, so the worktree survives; Promise.all only propagates genuinely unexpected errors instead of silently swallowing them.
• Single owner for the checked-out-branch refusal — removed the redundant downstream guard in fetchRemoteBranch; resolveWorktreeContext already refuses before it runs.
• Consolidated prompt-refusal formatters — dry-run and live messages now derive from one promptRefusalLines source (byte-identical output, verified by the existing tests).
• Consolidated worktree-discovery test mocks — one mockGitRepository scenario helper; dropped the exact call-count/order assertion.

Dependencies

• Bumped dev dependencies to latest: @types/node 25.9.3, fta-check 1.5.4, oxlint-config-j4k 2.7.4, semantic-release 25.0.5.
• @typescript/native-preview left on its beta tag (the beta dist-tag still points to 20260421.2; 20260614.1 lives on the separate latest channel).
• Lockfile deduped; lint clean under the new oxlint-config-j4k.

Notes

• Added .clawpatch/ to .gitignore (under "Local artifacts", alongside .codex/) so the tool's state directory isn't tracked and the pre-commit format:check doesn't scan it.

Verification

• Full local suite green on each commit (pre-commit hook runs format / knip / typecheck / lint / fta / test).
• Clean-checkout pnpm start verified: with dist/ removed it rebuilds dist/cli.js and the bin loads successfully.