feat(cli): implement cougr check hygiene command (#246)

[victor-134]

Summary

Implements cougr check — a first-class CLI hygiene command that exposes the existing hygiene logic from scripts/enforce_hygiene.sh and scripts/verify_hygiene.sh as a discoverable, contributor-facing tool.

Closes #246. Part of #238.

Background

scripts/enforce_hygiene.sh and scripts/verify_hygiene.sh already implement real hygiene checks used internally by maintainers, most recently in the #225 example-hygiene effort. However, they are not runnable by external contributors as a first-class command. This PR exposes that logic as cougr check.

Implementation approach

Decision: Ported to native Rust rather than shelling out to the existing bash/Python scripts.

Tradeoff rationale:

Approach	Pros	Cons
Shell out to bash/Python	Less code, exact parity with CI scripts	Requires bash + python3 on the contributor's machine; fragile error handling; platform-dependent
Native Rust (chosen)	Cross-platform (Windows/Linux/macOS); robust error handling; structured output; self-contained binary	More initial code; must stay in sync with bash scripts if they evolve

The native Rust approach makes cougr check a self-contained binary with no external script dependencies. It shells out only for git ls-files (tracked artifact detection) and cargo metadata --no-deps (build validation), which are required regardless of implementation language.

Checks implemented

All 8 checks from verify_hygiene.sh and the relevant diagnostic checks from enforce_hygiene.sh:

#	Check	Source
1	Root .gitignore must NOT ignore Cargo.lock	verify_hygiene.sh L16
2	No tracked target/ artifacts in git	verify_hygiene.sh L20
3	No tracked .wasm artifacts in git	verify_hygiene.sh L24
4	No hardcoded contract IDs (C[A-Z2-7]{55}) in example READMEs	verify_hygiene.sh L28
5	Each example has .gitignore with target/ ignored	verify_hygiene.sh L32-37
6	Example .gitignore must NOT ignore Cargo.lock	verify_hygiene.sh L35
7	Cargo.toml has non-empty description field	enforce_hygiene.sh §3
8	cargo metadata --no-deps passes for each example	verify_hygiene.sh L39-41

Usage

# From repo root — checks ALL examples
cargo run --bin cougr -- check

# From examples/snake/ — checks that single example
cd examples/snake && cargo run --bin cougr -- check

# Explicit repo root + single example
cargo run --bin cougr -- check --path /path/to/repo --example snake

Exit code 0 only if every check passes. Non-zero with an itemized failure list otherwise.

Files changed

File	Change
cli/Cargo.toml	New — CLI crate with clap, regex, anyhow
cli/src/main.rs	New — CLI entrypoint with cougr check subcommand
cli/src/check.rs	New — all 8 hygiene checks, context auto-detection
Cargo.toml	Modified — added cli to workspace members

Out of scope (v1)

• cougr check --fix (auto-correction mode) — v1 is diagnostic only
• Replacing scripts/enforce_hygiene.sh in CI — that migration is a separate decision for maintainers
• Checking Cargo.lock is committed (not in verify_hygiene.sh)

Definition of done

• cougr check run against a known-clean canonical example exits 0
• cougr check run against a deliberately broken fixture fails with specific diagnostics
• Output matches or exceeds the specificity of scripts/verify_hygiene.sh
• Run from project root checks every example; run from examples/<name>/ checks one
• Exit code 0 only if all checks pass; non-zero with itemized failure list

[drips-wave]

@victor-134 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[salazarsebas]

The 8 hygiene checks map cleanly to enforce_hygiene.sh/verify_hygiene.sh and cover what #246 asks for. Two things before merge:

• This PR also brings in the full verify.rs "Cougr Verified" logic and CI wiring for --verified --canonical-only, which is feat(showcase): implement the 'Cougr Verified' badge check #258's scope, not feat(cli): implement 'cougr check' hygiene command #246's — and feat(cli): add --output flag for verified badge showcase integration (#258) #280 already implements that independently. Could you strip the verify/--output logic from this PR and keep it focused on cougr check only? That avoids two divergent implementations of feat(showcase): implement the 'Cougr Verified' badge check #258 landing.
• No unit tests for the checks themselves — could you add coverage for at least the pass/fail paths?

Also flagging for visibility: this PR creates cli/Cargo.toml and cli/src/* from scratch, same as #279 and #280 — see the merge-order note on #288 for how we're sequencing the CLI crate so these don't collide.

[salazarsebas]

The check logic looks right, but the branch predates the cli/ scaffold that's now on main — your main.rs fully replaces the current one and drops the cougr new subcommand in the process, and GitHub is showing this as conflicting with main. Could you rebase onto main and wire check in as an additional subcommand alongside new rather than replacing main.rs?

[salazarsebas]

Closing — CI is failing: cargo fmt --check fails on this branch (see the failing Library Validation run). Happy to reconsider if you rebase and fix formatting.