nsbx: add one-command dev onboarding (branch + worktree + isolated engram)

Add 'nsbx dev <name>' / 'nsbx dev-down <name>' plus a Makefile so a newcomer
goes from clone to coding on an isolated cloned engram in one command. The
worktree is created on a real named branch at a persistent path (never /tmp,
guarded), and the whole worktree is pinned to the clone via an emitted .nsbx-env
so live :8742 / ~/.neuron/engram is unreachable by accident. Optimizes the El
edit->build->run loop so provisional work is built in El against a throwaway
clone instead of prototyped in Python and re-ported. Additive over the proven
primitives; no live cutover.

tools/neuron-sandbox/README.md

@@ -31,6 +31,64 @@ nsbx destroy <name>              # cheap teardown; live untouched
 That is the whole loop. Sane defaults: stock prod binary, auto-allocated port
 (`8900+`, never `8742`/`7770`), snapshot of the live store.
 
+## One-command dev onboarding — `nsbx dev` (start here)
+
+Going from a clone to *coding on the mind* is a single command. It creates a git
+**branch**, a persistent git **worktree**, and an **isolated engram** (a clone of the
+live store on a non-default port) — and wires the whole worktree to that clone so you
+**cannot hit live `:8742` by accident**.
+
+```bash
+make dev NAME=tim        # branch wt/tim + worktree + isolated engram, in one shot
+cd ~/Development/neuron-technologies/el-worktrees/tim
+source .nsbx-env         # every ENGRAM_* var now points at YOUR clone
+
+# edit El in the worktree, then the fast loop:
+make build NAME=tim      # compile your El change into the isolated engram
+make run   NAME=tim      # poke it (API=/api/stats by default)
+make test  NAME=tim      # run the safety rails as checks
+make destroy NAME=tim    # tear it all down (branch kept; live untouched)
+```
+
+**Why this exists:** so provisional/experimental work is built **directly in El against a
+throwaway cloned engram** — not prototyped in Python and re-ported later. The El
+edit → `make build` → `make run` loop is the path of least resistance; that double-work is
+what stranded the translation faculty for weeks.
+
+### What `nsbx dev <name>` does, in order
+
+1. **branch** — `git worktree add -b <prefix><name>` (default prefix `dev/`; a *real named
+   branch*, never detached HEAD).
+2. **worktree** — at a **persistent** path (default `…/el-worktrees/<name>`, override
+   `NSBX_DEV_WT_ROOT`). It **refuses** `/tmp` — temp dirs are ablated on compaction, which
+   is the exact "worktree in /tmp + no branch = lost work" failure this designs out.
+3. **isolated engram** — `nsbx create` under the hood: clone of the live store + WAL +
+   config, booted on an auto-allocated port (`8900+`, never `:8742`/`:7770`). Stock prod
+   binary by default (instant); `--build` compiles the worktree's own runtime instead.
+4. **env pin** — writes `.nsbx-env` (+ `.envrc` for direnv) into the worktree exporting
+   `ENGRAM_URL / ENGRAM_PORT / ENGRAM_DATA_DIR / ENGRAM_API_KEY / NEURON_ENGRAM_URL …` — all
+   pointing at the clone. Nothing references live.
+
+```
+nsbx dev <name> [--base REF] [--worktree DIR] [--port N] [--prefix P] [--build] [--no-engram] [--repo R]
+nsbx dev-down <name> [--delete-branch] [--repo R]      # destroy engram + remove worktree
+```
+
+### Makefile targets
+
+| target | does |
+|--------|------|
+| `make dev NAME=x` | branch + worktree + isolated engram (one shot) |
+| `make bt NAME=x` | fast El loop: `build` then `run` |
+| `make build NAME=x` | recompile the engram from the worktree's El source |
+| `make run NAME=x` | poke the isolated engram (`API=/api/stats`) |
+| `make test NAME=x` | rails as checks (`nsbx validate`) |
+| `make status [NAME=x]` | inspect one, or `list` all |
+| `make destroy NAME=x` | tear down (add `ARGS=--delete-branch` to drop the branch) |
+
+> Note: if a bare `dev` branch already exists in the repo, git can't create `dev/*` names —
+> pass `--prefix wt/` (or delete the stray `dev` branch). The tool surfaces git's exact error.
+
 ## The code-change dev loop (first-class)
 
 Run *your changed runtime*, not just the stock binary, against a snapshot: