Add a root whitaker binary behind an internal library boundary (3.5.1)

[leynos]

Execution plan for roadmap item 3.5.1 — add a root whitaker binary and move
the current installer behaviour behind an internal library boundary.

Plan document: docs/execplans/3-5-1-root-whitaker-binary.md

No production code changes. This PR is the plan only, and needs approval
before implementation begins.

What the plan delivers

A real whitaker binary with install and ls, doing what
whitaker-installer and whitaker-installer list do today — while
whitaker --all keeps working by forwarding to cargo dylint.
whitaker check and whitaker doctor remain with their own roadmap items.

Five milestones: extract the Dylint driver library (EP-M0), promote the
installer orchestration into its library (EP-M1), build the binary
(EP-M2), add binstall metadata and reserve the crates.io name (EP-M3),
then the ADR and documentation (EP-M4).

Why revision 2 looks different from a first draft

The plan was stress-tested by a six-perspective design review before
submission. Three findings changed the architecture, and the review is worth
knowing about when reading the Decision log.

The root package cannot be published. Verified directly:

$ cargo package -p whitaker --no-verify --allow-dirty
error: no matching package named `rustc_ast` found
warning: manifest has no description, license, ... or repository

It depends on four publish = false compiler-shim crates. So
cargo install whitaker — the plan's headline outcome — was unreachable.
Extracting the Dylint driver library into crates/whitaker_lint_core is
therefore a precondition rather than a contingency, and it is now EP-M0.
That also makes the root package testable, so CARGO_BIN_EXE_whitaker
becomes available to the end-to-end tests, and it stops ortho_config
propagating into eleven lint crates.

The whitaker name is already taken. installer/src/wrapper.rs:105
writes an executable named whitaker into the user's bin directory, and
Makefile:9 prepends ~/.cargo/bin while Makefile:6 appends
~/.local/bin — so a cargo installed binary deterministically shadows it.
That would break whitaker --all, which docs/users-guide.md documents as
the primary workflow and which this repository's own make lint runs, with
no replacement until 3.5.2. The binary now forwards unrecognized arguments to
cargo dylint.

Both original verification obligations were vacuous. Nothing in the
repository ever inverts a release-asset name, and both documented flag
conflicts are enforced by clap before any repository-owned routing code runs.
Proving properties of an unreachable branch is not evidence, so both were cut
and recorded as such. They are replaced by argv-classification totality and
disjointness — genuinely new logic introduced by the forwarding behaviour —
bounded by Kani and closed unbounded by Verus, each with a required negative
control.

Open questions for the reviewer

Three items are flagged in the Decision log rather than settled:

• D-6 — whether ortho_config earns its place at this milestone, given
  that NoOpLocalizer does not translate, so the dependency buys a one-line
  call-site difference until 3.6.4.
• D-7 — googletest and pretty_assertions are authorized by the task
  brief but the sibling plan for 7.3.1 ruled the other way, and neither crate
  is used anywhere in the workspace today.
• is_display_request's exact signature needs confirming before Stage B
  writes red tests against it.

Validation

make markdownlint and make nixie pass. make check-fmt, make typecheck
and make lint are unaffected — this change is documentation only.

References

• Roadmap item 3.5.1 — docs/roadmap.md
• Design: docs/whitaker-cli-design.md §Public CLI surface, §Compatibility and migration
• Lody session: https://lody.ai/leynos/sessions/0c485c79-c21a-486e-b126-29c3ef23084f

🤖 Generated with Claude Code

[sourcery-ai]

Sorry, we are unable to review this pull request

The GitHub API does not allow us to fetch diffs exceeding 300 files, and this pull request has 430

[coderabbitai]

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codescene-access]

No quality gates enabled for this code.