feat(hh): /pw command, RAM-only direnv autostart, robust lets-hack; coven→clergy

- add /pw (alias /password): reveal this room's password locally (never
  broadcast); surfaced in the F1 help overlay and the join hint
- direnv-autostart/: cd-to-launch a single real-user session via direnv;
  password is minted in memory at launch (never written to disk, matching the
  RAM-only model) and scoped to the child process. setup.sh installs direnv,
  hooks bash/zsh, and `direnv allow`s the dir
- lets-hack.sh: boot a FRESH server by default (replacing any live one) with a
  --reuse opt-out; add -h/--help/-help; guard against killing the tmux session
  you're attached to; switch-client into the coven when run inside tmux
- rename coven→clergy across rust/python/scripts; tests/test_coven.py→test_clergy.py
- snapshots in-progress hack-house client work (sandbox, themes, net, ui)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/direnv-autostart/.envrc

@@ -0,0 +1,35 @@
+# .envrc — cd into this directory to summon your hack-house ⛧
+#
+# Powered by direnv (https://direnv.net). Run ./setup.sh once to install direnv,
+# hook your shell, and `direnv allow` this file.
+#
+# Paths resolve RELATIVE TO THIS FILE — no hardcoded paths, so it works wherever
+# the repo is cloned (your own $universal/path/hackerhouse).
+
+# hh/ lives one level up from this autostart directory.
+export HH_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD/.envrc}")/.." && pwd)"
+
+# A single session, joined as the ACTUAL logged-in user (not the alice/bob demo).
+export SESSION="${HH_SESSION:-hackerhouse}"
+HH_USER="${HH_USER:-${USER:-$(id -un)}}"
+
+# Mint a strong room password — in MEMORY ONLY, at launch time. Nothing is ever
+# written to disk (matches the project's RAM-only secret model) and it is not
+# left in your shell environment: it is scoped to the lets-hack child process,
+# which boots the server and your client together so they share it. Reveal or
+# share it in-app with /pw. Honors a PW you export yourself.
+gen_pw() {
+    if command -v openssl >/dev/null 2>&1; then openssl rand -base64 24
+    else head -c 18 /dev/urandom | base64; fi
+}
+
+# Autostart needs tmux. lets-hack.sh boots a fresh server and a single pane for
+# $HH_USER, then (inside tmux) switches your client into it. Guard against
+# stacking: if the session is already live, just point at it.
+if ! command -v tmux >/dev/null 2>&1; then
+    echo "⛧ install tmux to autostart your hack-house"
+elif tmux has-session -t "$SESSION" 2>/dev/null; then
+    echo "⛧ '$SESSION' already live — tmux attach -t $SESSION   (reveal its password in-app with /pw)"
+else
+    PW="${PW:-$(gen_pw)}" "$HH_DIR/lets-hack.sh" "$HH_USER"
+fi

hh/direnv-autostart/setup.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# setup.sh — one-time setup for the hack-house direnv autostart ⛧
+#
+# Installs direnv (if missing), hooks your shell, and allows the .envrc in this
+# directory so that simply `cd`-ing here launches your hack-house session.
+#
+# usage:
+#   ./setup.sh            # set up autostart for THIS directory
+#   ./setup.sh --help
+#
+# After it finishes: open a new shell (or `source ~/.bashrc`), then `cd` into
+# this directory — your single-user clergy boots automatically.
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"   # the autostart dir (holds .envrc)
+
+case "${1:-}" in
+    -h|--help|-help)
+        sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'
+        exit 0 ;;
+    "") : ;;
+    *)  echo "✖ unknown argument: $1 (try --help)" >&2; exit 2 ;;
+esac
+
+# 1. ensure direnv is installed
+if command -v direnv >/dev/null 2>&1; then
+    echo "⛧ direnv already installed ($(direnv version 2>/dev/null))"
+elif command -v apt-get >/dev/null 2>&1; then
+    echo "⛧ installing direnv via apt…"
+    sudo apt-get update -qq && sudo apt-get install -y direnv
+elif command -v brew >/dev/null 2>&1; then
+    echo "⛧ installing direnv via brew…"
+    brew install direnv
+else
+    echo "⛧ installing direnv via the official script (→ ~/.local/bin)…"
+    mkdir -p "$HOME/.local/bin"
+    export bin_path="$HOME/.local/bin"
+    curl -sfL https://direnv.net/install.sh | bash
+fi
+command -v direnv >/dev/null 2>&1 || { echo "✖ direnv install failed — see https://direnv.net/docs/installation.html" >&2; exit 1; }
+
+# 2. hook direnv into the shell rc (idempotent). Covers bash and zsh.
+hook_line_bash='eval "$(direnv hook bash)"'
+hook_line_zsh='eval "$(direnv hook zsh)"'
+add_hook() { # $1 = rc file, $2 = hook line
+    local rc="$1" line="$2"
+    [[ -f "$rc" ]] || return 0
+    if grep -qF 'direnv hook' "$rc"; then
+        echo "⛧ shell hook already present in $rc"
+    else
+        printf '\n# direnv (hack-house autostart)\n%s\n' "$line" >> "$rc"
+        echo "⛧ added direnv hook to $rc"
+    fi
+}
+add_hook "$HOME/.bashrc" "$hook_line_bash"
+[[ -n "${ZDOTDIR:-}" && -f "$ZDOTDIR/.zshrc" ]] && add_hook "$ZDOTDIR/.zshrc" "$hook_line_zsh"
+[[ -f "$HOME/.zshrc" ]] && add_hook "$HOME/.zshrc" "$hook_line_zsh"
+
+# 3. allow this directory's .envrc
+if [[ ! -f "$HERE/.envrc" ]]; then
+    echo "✖ no .envrc in $HERE — is this the autostart directory?" >&2
+    exit 1
+fi
+direnv allow "$HERE"
+echo "⛧ allowed $HERE/.envrc"
+
+echo
+echo "⛧ done. open a new shell (or: source ~/.bashrc), then:  cd $HERE"
+echo "  your single-user hack-house boots automatically (fresh server, generated password)."