fix(hooks): approve post-switch against the removal's destination worktree

[max-sixty]

When a worktree is removed, the post-switch hook runs in the destination worktree — where the user lands — which prepare_worktree_removal records as RemoveResult.main_path (the primary worktree, except cwd when the primary worktree is itself the removal target). But wt remove's and wt step prune's approval gates collected the post-switch commands to prompt for from repo.home_path() instead. They agree in the common case (main_path == home_path()), so nobody noticed — but in a bare repo, removing the default-branch worktree from a different worktree, main_path == current_path while the gate read home_path(), so the gate approved the primary's post-switch while the executor ran cwd's — an unapproved project command could run. (wt merge and the picker's removal_hooks_approved, added in #2746, already passed the destination correctly.)

What changed

collect_remove_hook_commands now takes (removed_worktree_paths: &[&Path], destination_paths: &[&Path]) instead of (primary_repo: &Repository, removed_worktree_paths) — it collects pre-remove / post-remove from each removed worktree and post-switch from each destination (path-deduped, since the common case is the same primary repeated). New RemoveResult::destination_path() -> Option<&Path> returns main_path for RemovedWorktree, None for BranchOnly — a sibling of the existing removed_worktree_path(). Callers updated:

• wt remove (single): approve_remove(result.removed_worktree_path().as_slice(), result.destination_path().as_slice(), …). (Multi: the same projections over the plan list.)
• wt merge: passes &[destination_path] — matches finish_after_merge's RemoveResult { main_path: destination_path, … }.
• wt step prune: passes &[home_path()] — a prune candidate is never the primary worktree (gather_check_items filters non-linked worktrees and the default-branch worktree), so each candidate's removal destination is always home_path().
• The picker's removal_hooks_approved gains a main_path param and passes &[main_path].

The commands::hooks "Which .config/wt.toml a hook reads" table row for post-switch after a removal now points at RemoveResult::destination_path and notes the bare-repo cwd case.

Testing

Behavior-neutral in every case the test suite exercises — post-switch only fires when changed_directory (the removed worktree was cwd), and in all of those sub-cases main_path resolves to home_path() anyway, so the old and new gates collect the same commands. The change closes the latent decoupling. No new test added: the only observable difference is the bare-repo-remove-the-primary-from-elsewhere corner, and a dedicated integration test for it would be disproportionate; the new code paths (destination_path() on both variants, the destination loop in collect_remove_hook_commands, the main.rs plumbing) are covered by the existing wt remove / wt merge / wt step prune integration tests and the test_do_removal_* picker unit tests. cargo run -- hook pre-merge --yes is green (3693 tests, lints, fmt, doctests).

🤖 Generated with Claude Code