Worktree audit reads T3's configured worktree roots; runtime names the new preview tools - #68

Follow-ups from T3 Code nightly 0.0.46-nightly.20261006.2735.

What changes

• The worktree audit finds T3 worktrees wherever T3 creates them. T3 now lets users choose where new worktrees go (feat(server,web): choose where new worktrees are created pingdotgg/t3code#16231). worktree-audit.sh reads worktreesDirectory and previousWorktreesDirectories from T3's settings file at <T3 home>/userdata/settings.json, where <T3 home> is T3CODE_HOME or ~/.t3. It still counts the default <T3 home>/worktrees. It matches T3's handling. Values are trimmed with JavaScript's whitespace set, and relative paths and filesystem roots are ignored. Roots and candidates resolve physically, so a symlinked root still matches. previousWorktreesDirectories counts only when it is an array of strings, and jq and the Python fallback agree. --t3-worktrees or T3_WORKTREES replaces the settings roots for one run. The script still deletes nothing.
• The runtime names T3's new preview tools. t3/runtime.md adds preview_hover, preview_drag, preview_select, preview_upload, and preview_dialog to the control-ui mapping and the web verification step, with when to use each.

How it was verified

• Tests cover a custom root, previous roots, a symlinked root, malformed settings under each parser, ASCII and Unicode padding, and the overrides.
• A fresh agent given only the updated cleanup playbook described the managed roots and override precedence correctly, reading nothing else.
• A reviewer from another model family checked the script against T3's source over three rounds. It found the symlink, malformed-array, and trim mismatches, and confirmed each fix.
• python3 -m unittest discover -s tests passes. python3 scripts/build.py leaves no diff.