ww: own the scratch contract, drop the package cache, add -S

Scratch acquisition is one bare mkdir that refuses a pre-existing
.sepwork; the path reaches cleanup only after acquisition succeeds.
ww build and ww test -o keep the tree for the caller; ww run and
no-output ww test build under an owned /tmp/ww_{run,test}_<pid> dir
and remove it on every result, escalating rc on cleanup failure.
The content-keyed package cache is deleted from both stages; -S stops
after per-package .s emission; --sep is gone and unknown flags are
rejected; directory ww test delegates to the wwtest coordinator; the
wwstage driver routes every subprocess through os.exec.

The wwstage Makefile recipes move off the persistent <tool>_ww.d
build-in-place shape to a per-invocation mktemp workspace: the old
recipes relied on the retired pre-wipe semantics and any rebuild
would trip the new refusal on their leftover main.sepwork.

The three 989_pkgcache_* carriers lose their subject with the cache
and go with it; the rest of the wave's carrier adaptation follows in
its own commits.

.gitignore

@@ -1,12 +1,12 @@
 # Build outputs.
 /out/
 
-# Separate-compilation scratch dirs. `ww build` / `ww --sep` (the sole
-# build path post-#22 flip) drops <stem>.sepwork/ next to the OUTPUT
-# stem; an in-place build (no -o) lands it next to the source. The
-# Makefile byte-id gates read <stem>.sepwork/*.s deliberately (rule-10
-# #223 discriminator), so the dir is transient-not-tracked (CLAUDE.md
-# rule-14), never relocated.
+# Separate-compilation artifact dirs. `ww build` and explicit `ww test -o`
+# leave caller-owned <stem>.sepwork/ at the selected artifact stem; they
+# refuse to replace an existing tree. `ww run` and no-output single-file tests
+# put the executable and scratch in one driver-owned temporary directory and
+# remove both. Byte gates read selected files deliberately, then remove the
+# exact tree, so it is transient-not-tracked.
 *.sepwork/
 
 # Claude Code session artifacts.