fix(workflow): wt-rm removes only the named worktree (was auto-sweeping merged ones)

The first wt-clean.sh removed every worktree whose branch was merged into
origin/main — but long-lived branches (website, the ci line) are merged too,
so it would have deleted their worktrees. Caught on review before any real use.

Replace the auto-sweep with an explicit `wt-rm <branch>` that removes only the
named worktree; safety comes from git's own refusals — it won't remove a dirty
worktree (no --force) and deletes the local branch only when it's merged into
origin/main, otherwise keeps it (and its unmerged commits).

Update test-wt.sh to 15 checks (incl. "unnamed worktree untouched", primary
refused, dirty refused, unmerged branch preserved) and the wt-clean references
in ADR-0059 / CLAUDE.md / the README index.

docs/adr/0059-dev-workflow.md

@@ -75,9 +75,17 @@ Helpers:
 
 - **`scripts/wt-new.sh <branch>`** — fetch `main`, create the branch off
   `origin/main`, and add the sibling worktree; prints its path.
-- **`scripts/wt-clean.sh [--dry-run]`** — prune stale entries and remove
-  worktrees whose branch is merged into `origin/main` (refuses dirty ones;
-  never touches the primary or current worktree). Run it whenever.
+- **`scripts/wt-rm.sh <branch>`** — remove the worktree for the **named**
+  branch, and nothing else. It does **not** scan for "merged" worktrees to
+  auto-remove: long-lived branches (`website`, the `ci` line) are merged
+  into `main` too, so a merged-detection sweep would wrongly delete them
+  (caught immediately on review, before any real use — the initial design
+  was an auto-sweep `wt-clean`). Naming the target is the safety. Git's own
+  refusals do the rest: it won't remove a dirty worktree (no `--force`),
+  and it deletes the local branch only if it is merged into `origin/main`
+  (otherwise the worktree goes but the branch + its unmerged commits stay).
+  Stale bookkeeping for a hand-deleted directory is the built-in
+  `git worktree prune`'s job.
 
 ### D3 — Merge commits (`--no-ff`); never rebase or squash
 
@@ -164,7 +172,7 @@ test the script but not run its pushing path.
   get an ADR"). The maintainer-facing mechanics (worktrees, the reserve
   lock, the whitelist) live here and in `CLAUDE.md`, not in CONTRIBUTING.
 - Three scripts enter `scripts/`: `adr-reserve.sh`, `wt-new.sh`,
-  `wt-clean.sh`, each with a local-`origin` test harness
+  `wt-rm.sh`, each with a local-`origin` test harness
   (`test-adr-reserve.sh`, `test-wt.sh`) — the reserve script's allocation,
   idempotence, race-retry discriminator, and hard-abort paths are all
   covered (the real-remote push is exercised by the human running it).