feat(cli): add safe local config discovery

[limaronaldo]

Summary

Implements D.1 of the accepted local-client discovery ADR:

• adds agentshield discover with --no-default-paths, repeated --root, --format console|json, and --explain;
• keeps discovery CLI-private, separate from scan(), and preserves public Rust API and scan output contracts;
• reads only registry-allowlisted layouts through atomic handle-relative no-follow operations on Unix;
• fails closed with unsupported_filesystem_safety where that atomic primitive is unavailable;
• emits agentshield.discovery/v1 with redacted path references and deterministic budgets;
• adds adversarial symlink, special-file, concurrent-write, swap, malformed-source, deduplication, redaction, and CLI contract tests.

rustix 1.1.3 was already pinned transitively; this makes it a direct Unix-only dependency without adding a new crate version.

Safety

Discovery never executes configured commands, starts subprocesses, performs network access, expands values from configuration, or starts a scan. Missing allowlisted files remain a normal empty result. Explicit roots reject parent components, symlink ancestors, symlink roots, and filesystem roots.

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-targets --locked — 399 passed
• cargo check --workspace --all-targets --no-default-features --locked
• cargo clippy --workspace --all-targets --no-default-features --locked -- -D warnings
• cargo test --workspace --all-targets --no-default-features --locked — 365 passed
• git diff --check

A local Windows cross-check was blocked because the macOS host lacks the MSVC C headers/toolchain required by existing tree-sitter build scripts; native Windows CI is the authoritative platform check.

[limaronaldo]

Self-review verdict: semantically ready once CI is green.

• CLI-only boundary preserved; src/lib.rs exposes no discovery API
• default reads are exact registry paths; explicit roots use the same registry/parsers
• Unix opens every root/config component handle-relatively with no-follow flags
• unsupported platforms fail closed without a check-then-open read fallback
• symlink roots/components/configs and special files are not read
• concurrent writes and post-open symlink swaps are covered adversarially
• output uses schema v1, stable ordering/IDs, allowlisted fields, and redacted path refs
• candidate/open/directory/byte/entry limits are deterministic and bounded
• repeated-root limit regression is covered after review found and fixed an unbounded diagnostic path
• no command execution, network access, environment expansion from config, or automatic scan
• default and no-default-feature local gates are green

No unresolved code-review findings. Because the reviewer identity is also the author, this is a COMMENT rather than an approval.

[limaronaldo]

Windows CI fix pushed in 1bb25b9.

Root cause: the fail-closed non-Unix implementation compiled correctly, but native CI uses RUSTFLAGS=-Dwarnings; Unix-only status/diagnostic variants, the injected profile field, and an empty Unix-only test module were dead/unused on Windows.

Focused correction:

• project the complete v1 source-status and diagnostic-code catalogs through discover --explain on every platform;
• consult effective_profile consistently before representing a default-path observation on non-Unix;
• compile the filesystem unit-test module only on Unix.

No check-then-open fallback or Windows file read was added. Full default and no-default-feature local gates remain green.

[limaronaldo]

Final re-review at 1bb25b9: READY / no unresolved findings.

The Windows-only warning fix is contract-preserving: it makes the closed v1 status/diagnostic catalogs visible through --explain, reads the injected profile only to decide whether a default-path observation exists, and keeps all non-Unix source reads fail-closed. Native Windows, macOS, Ubuntu, feature-matrix, security, format, clippy, smoke, and Action E2E checks all pass (22/22). The worktree has no staged or tracked drift; only the intentionally local handoff file remains untracked.

Submitted as COMMENT because the author identity cannot approve its own PR.