refactor: Forge owns its checkouts

[RjBiermann]

Closes none — part of the architecture review (candidate 1: pull workdir out of the Forge interface).

What

start_work(number, branch) -> str allocates the build checkout and returns its path; new finish_work(number) removes it (tolerant no-op when the issue never started). Callers never name paths, so the adapter can never rmtree one it didn't create — the old caller-supplied workdir parameter let /retry run with `workdir=".") and have the adapter delete the repo checkout.

• process_issue owns the create/cleanup bracket (try/finally); run_once sheds its worktree plumbing
• repair's verification round now runs in the PR worktree (was cwd=".")
• build prompts switch to replace-based substitution — braces in an issue body crashed .format() before the agent ran

Adapter impact

Forge adapter interface changed — custom adapters need a two-line update (start_work returns the path; add finish_work). Declare minor at merge per ADR-0002.

Verification

$ python3 tests/test_devloop.py
queue full: 1 build(s) in flight (devloop/issue-9); nothing started — merge/close the open devloop PR(s) or raise pipeline.max_parallel
all checks passed