refactor(picker): route alt-r removal through handle_remove_output

[max-sixty]

The picker's alt-r removal (PickerCollector::do_removal) was a parallel reimplementation of the wt remove teardown pipeline — pre-remove hook → git worktree removal → post-remove (and post-switch) hooks — that had to be kept in lockstep with output::handle_remove_output by hand. #2736 had to fix the same hook-config bug in both. This routes do_removal through handle_remove_output, so the duplication is gone, and gates the picker's hooks on approval (which the old path didn't do).

What changed

handle_remove_output gains a silent flag (src/output/handlers.rs). When set, a RemovedWorktree result is removed with no progress/success messages, no trash-cleanup spinner, and no cd directive — just pre-remove, the synchronous git worktree removal (remove_removed_worktree_silently), and post-remove / post-switch hook registration. Required because the picker runs do_removal from a background thread spawned off skim's event loop, so any wt-generated stderr output would corrupt skim's frame. silent is the only new knob; it threads through the five handle_remove_output call sites as false everywhere except the picker.

do_removal is now a thin call into handle_remove_output (src/commands/picker/mod.rs). The RemovedWorktree arm drops its hand-rolled pre-remove (CommandContext + execute_hook) / git removal / post-remove (PostRemoveContext + HookAnnouncer::register_with_project_config) code — net ~80 lines, plus the removed_project_config snapshot plumbing #2736 added now lives in one place. The BranchOnly arm is unchanged (it's small and handle_remove_output's BranchOnly path prints things the picker can't have).

The picker's hooks now run only when already approved. The old do_removal ran project pre-remove / post-remove / post-switch hooks unconditionally — it was the one removal/switch path that bypassed the approval gate, so a freshly-cloned repo's post-switch hook would fire on alt-r. The picker can't show an approval prompt mid-render, so it now consults Approvals read-only (removal_hooks_approved — the same collect_remove_hook_commands set wt remove would prompt for, checked against Approvals::is_command_approved) and passes the result as verify; when it's false, execute_pre_remove_hooks_if_needed and spawn_hooks_after_remove early-return. CLAUDE.md gains a "Project Commands Run Only After Approval" section stating the general rule (src/commands/command_approval.rs is the gate; never build a path that runs project commands without it; a context that can't prompt skips the unapproved ones).

One behavior delta beyond consolidation: removing the current worktree via alt-r now also registers post-switch hooks for the home worktree (if approved), matching wt remove / wt merge / wt step prune. The old do_removal registered only post-remove.

Testing

cargo run -- hook pre-merge --yes is green (3690 tests). The test_do_removal_* unit tests cover the silent removal path (worktree + branch + detached), and a new test_do_removal_skips_unapproved_pre_remove_hook covers the approval gating (removal_hooks_approved is fully covered). Not covered: the two lines in invoke()'s alt-r spawn block that hand the Approvals snapshot to the removal thread — invoke() is already documented as not unit-testable ("Full invoke() tests require interactive skim"), and the rest of its body is uncovered too; the approval-check logic itself is. No end-to-end test exercises "hook present and approved → runs" through the picker (would need seeding Approvals against the test repo's path) — the unit test asserts the logic, just not that exact integration.

🤖 Generated with Claude Code

[worktrunk-bot]

codecov/patch is failing — 4 added lines uncovered out of ~110. CLAUDE.md requires explicit maintainer approval before merging with failing codecov/patch, so dismissing my approval; reapply or override as appropriate.

The misses:

File	Line	Code	Note
src/output/handlers.rs	1500	)?;	Error-propagation ? on the new remove_worktree_with_cleanup call in remove_removed_worktree_silently. Happy path is covered by the new test_do_removal_* tests; only the failure branch is uncovered.
src/commands/worktree/finish.rs	172	)?;	Reformat artifact — the single-line handle_remove_output(..., announcer)? call was split across multiple lines to add the new silent parameter, and Codecov flagged the closing )?; as a new uncovered line. The error branch was likely also unmeasured before.
src/commands/picker/mod.rs	314	let approvals = Arc::clone(&self.approvals);	Inside invoke()'s alt-r spawn block — acknowledged in the PR description as not unit-testable (Full invoke() tests require interactive skim).
src/commands/picker/mod.rs	318	if let Err(e) = Self::do_removal(...)	Same invoke() block.

The two invoke() lines are the ones the PR description already flagged. The other two are ? error-propagation closings whose happy paths are covered but whose Err branches would need failure injection (a forced remove_worktree_with_cleanup failure / a failed handle_remove_output from finish_after_merge) — straightforward but a real test addition rather than a one-line fix.

codecov/patch failed — see comment for analysis; reapply once addressed or override per CLAUDE.md policy.