fix: fail-closed capture surface (iss-29)

[REPPL]

Fixes ledger issue iss-29 fail-closed-capture-surface — three coupled instances behind the unrecognized-input-never-writes detector, each armed with a watched-fail acceptance test.

What was broken

1. A typo'd subcommand became a ledger mutation. abcd capture resovle iss-1 note — resovle being a typo for resolve — fell through the capture parent's arbitrary-args RunE and was filed as a brand-new issue.
2. --json errors emitted raw Go text, not JSON — a machine caller could not parse a failure the way it parses a success.
3. docs lint with no config leaked the absolute config path in a raw os.ReadFile error.

The fix

• suspectedTypoedSubcommand refuses a mistyped subverb with a did-you-mean and writes nothing. It is deliberately high-precision: it fires only when the first token is a near-miss (edit distance 1–2) to a real subverb and the shape looks like a subcommand call — a lone token, or a token followed by an iss-N id — so genuine multi-word free-text captures still file.
• A new cli.Run(args, stdout, stderr) int seam (extracted from main.go in a separate behaviour-preserving refactor commit) renders the error diagnostic as a {"error": …} envelope under --json.
• docs lint now reports a clean, repo-relative diagnostic for a missing or unreadable config; a *PathError's inner cause is reported without its path.

Detector-first evidence

internal/surface/cli/capture_surface_test.go — 5 acceptance tests (typo-never-writes, free-text-still-writes guard, --json error shape, missing-config clean error, unreadable-config no-path-leak) watched fail before the fix, green after. make preflight clean (build, gofmt, vet, test, -race).

Review

• Correctness (ruthless-reviewer): PROMOTE.
• Security (security-reviewer): initial BLOCK — the non-not-exist docs-lint branch still leaked the abspath via *PathError; fixed (strip the path-bearing wrapper) and re-reviewed PASS.

Scope split

The reviewers noted a systemic version of instance 3: cli.Run now routes all command errors through the --json envelope, so any verb returning a bare *fs.PathError widens a pre-existing stderr-text abspath leak into --json. That is out of iss-29's scope and pre-existing, so it is filed separately as iss-76 rather than fixed here.

Commits

• refactor: extract cli.Run for testable error rendering (behaviour-preserving)
• fix: fail-closed capture surface (iss-29), resolve folded into the branch
• chore: capture iss-76

Do not merge / no auto-merge — maintainer merges fix: PRs.

Assisted-by: Claude:claude-opus-4-8