CB-WP-0004 T01: fix environment friction at the root

CB-RES-0003 measured 84 turns and $15.33 — the largest mechanical
category — spent prefixing commands with `cd` and
`export PATH="$HOME/.cargo/bin:$PATH"`. Both causes are now fixed once
instead of per-leaf.

tools/repo.py resolves the repo root from __file__ and cargo from PATH
then the standard rustup locations. Every tool imports ROOT from it, so
the repo path is stated once rather than redefined in four files —
single source of fact, the rule DFD earned in InnerLoop v1.2.
rule-coverage and dep-weight now call enter_root(), which is why their
relative paths did not need rewriting one by one.

The Makefile derives REPO from MAKEFILE_LIST and resolves CARGO the same
way, so `make -C <repo> <target>` works from any directory with no
prefix.

make env-test is the positive control, and is in `make all`: every tool
runs from / with PATH=/usr/bin:/bin. Without it this fix could regress
silently and invalidate T05's measurement — the whole point of the
control loop.

dep-weight's "cargo not on PATH" error is kept rather than deleted. It
should now be unreachable, and --self-test asserts cargo_bin() resolves
unaided; a control that never fires is cheaper than a regression.

loop-lint failed on repo.py on its first run — a reporting tool with a
positive control but no --self-test entry point. Second time the gate
has caught work from its own pass within the hour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CB-WP-0004-mechanical-work.md

@@ -1,7 +1,7 @@
 ---
 id: CB-WP-0004
 title: "Move mechanical turns off the token budget, and prove it worked"
-status: proposed
+status: in_progress
 state_hub_workstream_id: "6880ac78-d817-41b9-b267-f12ff9deea28"
 ---
 
@@ -41,7 +41,7 @@ unless the instrument disproved it (§Step 4, correction vs retarget).
 
 ```task
 id: CB-WP-0004-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3ddfd3e2-8596-4969-a069-09577933fcbc"
 ```
@@ -64,6 +64,23 @@ still cheaper than a regression.
 **Predicted:** environment-setup turns → **< 10** (from 84),
 **$12–15** recovered. Highest confidence in the review.
 
+**Delivered.** `tools/repo.py` resolves the repo root from `__file__` and
+`cargo` from PATH-then-rustup-locations; every tool imports it, so `REPO`
+is now stated once rather than four times. The Makefile derives `REPO`
+from `MAKEFILE_LIST` and resolves `CARGO` the same way. `make env-test`
+is the positive control — it runs every tool from `/` with
+`PATH=/usr/bin:/bin`, and is wired into `make all`, so this cannot
+silently regress and invalidate T05's measurement.
+
+The leaf workaround in `dep-weight.py` was kept, not deleted: it is now
+unreachable on a rustup machine, and `--self-test` asserts `cargo_bin()`
+resolves unaided. Per the task text, a control that never fires is
+cheaper than a regression.
+
+`loop-lint` failed on `repo.py` immediately — a new tool with a positive
+control but no `--self-test` entry point. Second time the gate has caught
+its own pass's work within the hour.
+
 ## Task: `make task-done` — one command for a task close
 
 ```task