feat: wt setup --repair, --dry-run, and idempotent Docker

[pkudinov]

Summary

Fixes the bug where re-running wt setup could break a healthy worktree's Docker services (port-bind conflicts during spurious recreates), and adds a way to repair stale port allocations in place without losing the worktree directory.

Plain wt setup is now idempotent for Docker

Per-service compose-config hashing (sha256 truncated to 12 hex chars) is stored in the allocation. On every wt setup, current hashes are compared to stored; only services whose hash actually changed are stop+force-recreated, the rest stay running. The up invocation is --no-recreate so Docker's own diff never triggers a surprise recreate. Migration: missing serviceHashes (pre-upgrade allocations) are treated as in-sync — current hashes are stored as a baseline without recreating anything.

wt setup --repair

Re-allocates ports for an existing worktree as if creating it fresh now, treating the slot's own currently-registered ports as not-reserved (allocateServicePorts gets a new excludeSlot option). Useful when an external process has seized a port, or when an allocation predates port-drift (v0.4.1). wt remove is intentionally not the answer — it would delete the worktree directory and any uncommitted work.

wt setup --dry-run

Used with --repair. Prints the proposed reallocation and exits without writing to the registry, env files, Docker, or running postSetup. Errors out if used without --repair.

Targeted Docker recreate path

When recreation is needed, the sequence is compose stop <svcs> → compose up -d --force-recreate --no-deps <svcs> → final compose up -d --no-recreate --remove-orphans. The explicit stop releases the port before the new container needs to bind it, so the original failure mode is gone.

JSON output

Adds portChanges (per-service { service, registered, proposed, reason }), recreatedDockerServices, repaired, and dryRun to setup payloads.

Spec: `docs/superpowers/specs/2026-04-25-setup-repair-design.md`
Plan: `docs/superpowers/plans/2026-04-25-setup-repair-and-idempotent-docker.md`

Bumps version to 0.4.2.

Test Plan

• `pnpm lint` clean
• `pnpm test` — 118 passing, 1 skipped (pre-existing docker integration suite)
• `pnpm exec tsc --noEmit` clean
• `pnpm build` clean
• In a downstream consumer, run `wt setup` twice on a healthy worktree — second run produces no docker output (no recreation).
• In a downstream consumer with a stale port allocation: `wt setup --repair --dry-run` shows the expected reallocation; `wt setup --repair` applies it; the worktree directory and database are preserved.

🤖 Generated with Claude Code