Document genrewatch, img and vid; stop vitest walking into worktrees

[ralyodio]

Two things: the docs the three new commands were missing, and a test-collection bug found while writing them.

The docs

genrewatch, img and vid were on PATH and in cli-tools list (which reads bin/, so it is never stale) but absent from both hand-maintained tables. Added, with a section each, plus two new system requirements:

• ffmpeg — a hard requirement for vid, not a degradation. Nothing on npm decodes video the way sharp handles images.
• ImageMagick — img only, and only for what sharp cannot do (PDF, PSD, animated GIF).

vitest was collecting other branches' tests

There was no vitest config, so the default glob walked into .claude/worktrees/ — which is inside the repo — and picked up the tests of every open worktree. With one worktree here, pnpm test reported 21 files / 427 tests against a real suite of 14 / 284.

The wrong count is the harmless half. Those files are somebody's in-progress branch, so a run can:

• fail on code that is not on this branch at all, or
• pass because a half-finished test over there happened to cover the thing you just broke.

Either way the suite stops describing the checkout you are standing in — and both EnterWorktree and git worktree add put trees there by default, so this triggers on ordinary use.

Verified both directions with a deliberately failing decoy at .claude/worktrees/probe/test/decoy.test.ts:

without vitest.config.ts:  1 failed | 14 passed (15 files)
with it:                   14 passed (14 files)

The default excludes are restated in the config because setting exclude replaces them rather than extending them.

Verification

• 284 tests pass, pnpm typecheck clean.
• Every --help quoted in the new README sections was read from the actual command, not inferred.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

6 finding(s)

MEDIUM: 1 | LOW: 5

Severity	Rule	Location
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
LOW	insecure-temp-file	test/blog.test.ts:73
LOW	insecure-temp-file	test/blog.test.ts:74
LOW	insecure-temp-file	test/credentials.test.ts:43
LOW	insecure-temp-file	test/credentials.test.ts:44
LOW	secret-generic-api-key	test/credentials.test.ts:208

Snippets are redacted; ThreatCrush never prints matched credential material.