[zdk]

What changes

• Named rules. A .lf file can declare rule <name>: blocks with sub, level, exit and flag fields and a do: body. A rule whose fields do not hold is skipped, so the next rule runs. Old selector: rules still parse.
• Flag spellings. Flag guards accept -o|--output json.
• JSON guard. The guard now handles back-to-back documents and warning lines before or after the JSON. Filtered output with leftover fragments is rebuilt from the raw JSON.
• Piped JSON. rewrite sets LOWFAT_PIPED=1 when stdout is piped or redirected. With it set, JSON output passes through byte-exact, so kubectl get pods -o json | jq sees real data.
• CI. New Test workflow runs cargo test --workspace on pull requests and on main.
• Version bumped to 0.9.0.

Testing

• cargo test --workspace passes in a Linux container.
• New crates/lowfat/tests/json_e2e.rs runs 2,880 end-to-end cases. It fails on the previous guard code (810 broken) and passes here.
• Replayed 338 real read-only commands from local history: exit codes kept, no output lost, JSON valid.

Notes

• Piped JSON is no longer reduced. That is the cost of downstream parsers getting exact data.
• Plugins that use rule blocks need lowfat 0.9.0 or newer.