Add gt role command group for env-based role detection (gt-1xsah)

- New gt role subcommands: show, home, detect, list, env
- Role detection now checks GT_ROLE env var first, falls back to cwd
- gt prime shows warning when role/cwd mismatch detected
- gt mol status uses env-aware role detection
- gt handoff injects GT_ROLE and resets to role canonical home
- Fixed witness/refinery home paths (was missing /rig suffix)

This prevents role confusion when agents wander to wrong directories.
After handoff, agents are always restored to their canonical home.

internal/cmd/molecule_status.go

@@ -215,11 +215,21 @@ func runMoleculeStatus(cmd *cobra.Command, args []string) error {
 		// Explicit target provided
 		target = args[0]
 	} else {
-		// Auto-detect from current directory
-		roleCtx = detectRole(cwd, townRoot)
+		// Auto-detect using env-aware role detection
+		roleInfo, err := GetRoleWithContext(cwd, townRoot)
+		if err != nil {
+			return fmt.Errorf("detecting role: %w", err)
+		}
+		roleCtx = RoleContext{
+			Role:     roleInfo.Role,
+			Rig:      roleInfo.Rig,
+			Polecat:  roleInfo.Polecat,
+			TownRoot: townRoot,
+			WorkDir:  cwd,
+		}
 		target = buildAgentIdentity(roleCtx)
 		if target == "" {
-			return fmt.Errorf("cannot determine agent identity from current directory (role: %s)", roleCtx.Role)
+			return fmt.Errorf("cannot determine agent identity (role: %s)", roleCtx.Role)
 		}
 	}
 
@@ -546,11 +556,21 @@ func runMoleculeCurrent(cmd *cobra.Command, args []string) error {
 		// Explicit target provided
 		target = args[0]
 	} else {
-		// Auto-detect from current directory
-		roleCtx = detectRole(cwd, townRoot)
+		// Auto-detect using env-aware role detection
+		roleInfo, err := GetRoleWithContext(cwd, townRoot)
+		if err != nil {
+			return fmt.Errorf("detecting role: %w", err)
+		}
+		roleCtx = RoleContext{
+			Role:     roleInfo.Role,
+			Rig:      roleInfo.Rig,
+			Polecat:  roleInfo.Polecat,
+			TownRoot: townRoot,
+			WorkDir:  cwd,
+		}
 		target = buildAgentIdentity(roleCtx)
 		if target == "" {
-			return fmt.Errorf("cannot determine agent identity from current directory (role: %s)", roleCtx.Role)
+			return fmt.Errorf("cannot determine agent identity (role: %s)", roleCtx.Role)
 		}
 	}