feat(hh): /pw command, RAM-only direnv autostart, robust lets-hack; coven→clergy

- add /pw (alias /password): reveal this room's password locally (never
  broadcast); surfaced in the F1 help overlay and the join hint
- direnv-autostart/: cd-to-launch a single real-user session via direnv;
  password is minted in memory at launch (never written to disk, matching the
  RAM-only model) and scoped to the child process. setup.sh installs direnv,
  hooks bash/zsh, and `direnv allow`s the dir
- lets-hack.sh: boot a FRESH server by default (replacing any live one) with a
  --reuse opt-out; add -h/--help/-help; guard against killing the tmux session
  you're attached to; switch-client into the coven when run inside tmux
- rename coven→clergy across rust/python/scripts; tests/test_coven.py→test_clergy.py
- snapshots in-progress hack-house client work (sandbox, themes, net, ui)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/direnv-autostart/.envrc

@@ -0,0 +1,35 @@
+# .envrc — cd into this directory to summon your hack-house ⛧
+#
+# Powered by direnv (https://direnv.net). Run ./setup.sh once to install direnv,
+# hook your shell, and `direnv allow` this file.
+#
+# Paths resolve RELATIVE TO THIS FILE — no hardcoded paths, so it works wherever
+# the repo is cloned (your own $universal/path/hackerhouse).
+
+# hh/ lives one level up from this autostart directory.
+export HH_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD/.envrc}")/.." && pwd)"
+
+# A single session, joined as the ACTUAL logged-in user (not the alice/bob demo).
+export SESSION="${HH_SESSION:-hackerhouse}"
+HH_USER="${HH_USER:-${USER:-$(id -un)}}"
+
+# Mint a strong room password — in MEMORY ONLY, at launch time. Nothing is ever
+# written to disk (matches the project's RAM-only secret model) and it is not
+# left in your shell environment: it is scoped to the lets-hack child process,
+# which boots the server and your client together so they share it. Reveal or
+# share it in-app with /pw. Honors a PW you export yourself.
+gen_pw() {
+    if command -v openssl >/dev/null 2>&1; then openssl rand -base64 24
+    else head -c 18 /dev/urandom | base64; fi
+}
+
+# Autostart needs tmux. lets-hack.sh boots a fresh server and a single pane for
+# $HH_USER, then (inside tmux) switches your client into it. Guard against
+# stacking: if the session is already live, just point at it.
+if ! command -v tmux >/dev/null 2>&1; then
+    echo "⛧ install tmux to autostart your hack-house"
+elif tmux has-session -t "$SESSION" 2>/dev/null; then
+    echo "⛧ '$SESSION' already live — tmux attach -t $SESSION   (reveal its password in-app with /pw)"
+else
+    PW="${PW:-$(gen_pw)}" "$HH_DIR/lets-hack.sh" "$HH_USER"
+fi