#1126 Check a package's own guidance content before it ships

[williamthorsen]

What

Adds a validate command that checks the CodeAssembly guidance bundled with a package and reports all defects found. The check covers every type of content and all harnesses to which it could be deployed.

Why

Opening guidance production to any npm package left every correctness gate still assuming the content root was this repository's own. A package could publish guidance it had no way to check, and a consuming repository got only partial cover, because its checks ran over the closure it declared rather than over the catalog its dependencies ship. When a mechanism opens to third parties, what guards it has to be reachable as a command.

Details

🎉 Features

• codeassembly-agents validate runs the checks a consumer's install runs before writing — dependency closure, artifact resolution, delivery collisions, and a per-harness render — over a whole content root, requiring no consuming declaration and writing nothing.
• The root comes from --content <dir>, or from the codeassembly.content key the package's package.json already declares; neither yielding one is an error naming both routes.
• --harness narrows the run to one harness; the default checks every harness the root could deploy to, so a defect that reaches only one is not missed. A defect every harness raises collapses to a single line, while one confined to a subset names the harnesses it reaches.
• Coverage is everything the root ships that reaches a consumer: rulebooks, skills, subagents, collections, and the support entries under skills/ that carry no SKILL.md.
• Defects are confined to artifacts the content root owns. A dependency edge still resolves into the built-in library so it resolves the way it will at a consumer, but a library defect is not reported against a path the producer does not have; an edge that resolves from nowhere is still reported, against the artifact that declared it.
• A clean root exits 0; any defect exits 1 after a report grouped by file.

🐛 Bug fixes

• A SKILL.md that is itself a directory is no longer mistaken for a skill, so an entry carrying one installs as the support content it is. Such an entry previously deployed through neither pass — skipped by the installer as the sync pass's to handle, and absent from the catalog the sync pass walks.
• Installing from content that ships no skills/ directory names the missing path and says what it skipped, the way a missing scripts/ or guidance directory already does.

♻️ Refactoring

• Four rules that the install, sync, and validate passes each have to apply identically now have one definition apiece: what counts as a skill directory, which entries under skills/ are support content, the harness-relative prefix a deployed skill's links are built under, and how a support entry renders. Each was previously copied per caller.
• Source-directory validation and the two skill-name collision rules are available to callers outside the sync command, which previously held them privately. Each collision rule comes in two forms — one returning the collisions it finds, one throwing on the first — so a caller that must collect every defect and a caller that must stop before writing share one rule.
• Each CLI subcommand group resolves in its own function, bringing the top-level dispatcher back under the configured complexity ceiling.

📚 Documentation

• The command list and flag reference cover validate and --content, and the package-producer walkthrough shows how to wire the check into a producer's own build, what it covers, and which exit code each outcome carries.

Closes #1126

[github-actions]

Dependency audit

Production dependency audit passed.