feat(own-cli): the production Rust OwnIR executable (#261 H.2)

`own-cli ownir <facts> [--format F] [--severity S] [--verbosity V]` — the one
core invocation the product seam makes today, as a native binary behind the
unchanged launcher. It reproduces the reference byte for byte over all 80
frozen cases: argument handling, the display policy, the stream split, the
four formats and every exit code.

The two halves have different oracles, and the boundary is the surface (C-1).
The top-level shell follows the public `owen` convention — a parity surface of
its own, with no Python byte oracle, written once and shared with the fixture
manifest. Everything after `ownir` is the reference as measured, including
the parts that surprise: a positional-count error prints the whole module
docstring to STDOUT with exit 2, and an unknown flag is a positional rather
than an error. `ownir --help` is the one case declared a defect and not
ported.

What it reuses and what it owns:

* `own_bridge::check_facts` is the analysis and `render_finding` /
  `build_sarif` are the renders — already byte-pinned by BR-V9, never
  re-derived here;
* the CLI owns the display policy, because it is CLI logic. It is a pure
  function of the findings and the three options, so the traps are unit tests
  rather than process invocations: the exit is `1 if leaks else 0` and no
  option moves it, `quiet` hides advisories and nothing else, the `ok` line
  fires on `not shown` so an all-suppressed document prints ok AND a tally,
  and the verbose breakdown counts every finding;
* the CLI owns the SARIF SERIALIZATION, because `cmd_ownir` writes the same
  document `json.dumps(indent=2)` does — pure ASCII with `\uXXXX` escapes and
  a surrogate pair above the BMP — while the BR-V9 goldens are
  `ensure_ascii=False`. Two byte shapes, one builder; the builder is untouched.

The process contract, under `panic = "unwind"`: a hook suppresses the default
panic output and records the payload, and a top-level `catch_unwind` turns the
unwind into one actionable stderr diagnostic and exit 70, never 101. The hook
alone would only observe the panic. Under OWNLANG_DEBUG the payload and a
captured backtrace print and the exit is still 70 — the asymmetry `run()`
keeps, because exit 1 reads as findings. An off-by-default `fault-injection`
feature gates the two dev-only hooks that force each failure mode, so both are
measured rather than asserted.

The DAG gains exactly two edges, `own-cli -> own-ir` and `own-cli ->
own-bridge`, registered in `dag.rs` where an unregistered member fails the
whole `cargo test`. No `own-codegen`, no `own-shadow`, no `sha2`.

The `panic`-per-binary note above `[profile.release]` is corrected in place as
a design note: Cargo cannot set `panic` per package — a profile applies to
every target of a build — so `abort for own-cli` was never a plan Cargo could
execute. Nothing about the built artifacts moves.

Refs #261, #345, #262, #250

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DTGMj7edRtjhyeXzkeiSWv

Author: claude

rust/Cargo.lock

@@ -8,7 +8,7 @@
 
 [workspace]
 resolver = "2"
-members = ["crates/own-ir", "crates/own-syntax", "crates/own-cfg", "crates/own-diagnostics", "crates/own-analysis", "crates/own-lowered", "crates/own-bridge", "crates/own-shadow"]
+members = ["crates/own-ir", "crates/own-syntax", "crates/own-cfg", "crates/own-diagnostics", "crates/own-analysis", "crates/own-lowered", "crates/own-bridge", "crates/own-shadow", "crates/own-cli"]
 
 [workspace.package]
 edition = "2021"
@@ -51,8 +51,20 @@ panic = "deny"
 dbg_macro = "deny"
 print_stdout = "deny"
 
-# Release profile per P-022 — panic is per-binary, NOT set here: "abort" for
-# own-cli, "unwind" for any LSP binary (salsa cancels via unwinding).
+# Release profile per P-022. `panic` is deliberately NOT set here, and the note
+# that used to stand in this place — "panic is per-binary: abort for own-cli,
+# unwind for any LSP binary" — was a stale design note rather than a plan Cargo
+# can execute: a profile applies to EVERY target of a build, so there is no
+# per-package `panic` and a `panic = "abort"` written here would abort the whole
+# workspace, an LSP binary included.
+#
+# The workspace therefore keeps the default `unwind`, and #261 rules that this
+# is the contract build for `own-cli`: a custom panic hook suppresses the
+# default output and a top-level `catch_unwind` turns an ordinary panic into one
+# actionable stderr diagnostic and exit 70 (never 101). A hook alone would only
+# OBSERVE the panic; the catch is what produces the exit code, and it needs
+# unwinding to exist. Corrected here and in its P-022 mirror as a design note,
+# not as a behaviour change: nothing about the built artifacts moves.
 [profile.release]
 lto = "thin"
 codegen-units = 1

rust/Cargo.toml

@@ -0,0 +1,52 @@
+# The production OwnIR executable (P-022 step 7b, #261). P-022's crate plan
+# names `own-cli` the entry point, and this is it, created with the single
+# `ownir` subcommand — the one core invocation the product seam makes today
+# (`own-check.sh`, `own-check.ps1`, the Action and `owen check` all run
+# `python -m ownlang ownir <facts> --format F --severity S`, and nothing else).
+# #345 adds `cfg`/`summaries`/`explain`/`.own check`/`emit` to THIS binary
+# later, so the dispatch is one table and the help is one surface rather than a
+# special case those commands would have to rewrite.
+#
+# The DAG (own-diagnostics/tests/dag.rs): `own-ir` for the typed strict door and
+# `own-bridge` for the analysis and the renders. Nothing else — the CLI holds no
+# analysis and no bridge logic, only argument handling, I/O, the display policy
+# and the process contract. `own-bridge` may be depended on ONLY by entry-point
+# crates, and this is the one P-022 named.
+[package]
+name = "own-cli"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+description = "own-cli: the production OwnIR executable (`own-cli ownir`), parity with `python -m ownlang ownir`"
+
+[[bin]]
+name = "own-cli"
+path = "src/main.rs"
+
+[dependencies]
+own-ir = { path = "../own-ir" }
+own-bridge = { path = "../own-bridge" }
+# The SARIF log is serialized here rather than in the bridge because the CLI's
+# byte shape is NOT the fixture emitter's: `cmd_ownir` prints
+# `json.dumps(indent=2)` with `ensure_ascii` left at its default, so the CLI
+# path is pure ASCII with `\uXXXX` escapes, while the BR-V9 goldens are
+# `ensure_ascii=False`. Two byte shapes, one builder — see src/sarif.rs.
+serde_json.workspace = true
+# Unicode general categories, the data behind CPython's `str.isprintable()`.
+# The reference interpolates `repr()` of a rejected flag value
+# (`unknown --format {fmt!r}`), so byte-identical usage errors need CPython's
+# quoting rules. Not a workspace-crate edge: `own-syntax` owns the same helper
+# but the DAG does not admit `own-cli -> own-syntax` (see src/pyrepr.rs).
+unicode-properties.workspace = true
+
+[features]
+# OFF by default and absent from every production build. It gates two dev-only
+# hooks that force the two failure modes #261 rules on, so the forced-panic and
+# forced-death controls are MEASURED by the integration test rather than
+# asserted from the design. See src/faults.rs.
+fault-injection = []
+
+[lints]
+workspace = true

rust/crates/own-cli/Cargo.toml

@@ -0,0 +1,48 @@
+//! The two forced-failure controls, behind the off-by-default
+//! `fault-injection` cargo feature.
+//!
+//! #261 rules on two failure modes:
+//!
+//! ```text
+//! catchable panic    -> exactly one actionable stderr diagnostic + exit 70,
+//!                       never 101
+//! uncatchable death  -> a visible hard failure: non-zero, outside
+//!                       {0, 1, 2, 70}, no findings, no `ok` line, never
+//!                       masked. NO particular OS exit number is contracted.
+//! ```
+//!
+//! Both are *measured* rather than asserted from the design, which needs a way
+//! to make them happen on demand — and a production binary must not carry one.
+//! Hence the feature: `cargo build -p own-cli` compiles [`maybe_inject`] to a
+//! `const fn` with an empty body, and only
+//! `cargo test -p own-cli --features fault-injection` builds the hooks at all.
+//!
+//! The panic is raised with [`std::panic::panic_any`] rather than the `panic!`
+//! macro. That is not a way around the workspace's `clippy::panic` deny — it is
+//! the right API for this job: `panic_any` takes the payload as a value, which
+//! is exactly what the diagnostic has to recover and print, so the control
+//! exercises the payload path a real panic would take instead of a stringly
+//! special case.
+
+/// Force one of the two failure modes when the environment asks for it.
+///
+/// Called after argument parsing, so the control travels the same path a real
+/// panic in the analysis would: through `catch_unwind` in `main`, with the hook
+/// already installed.
+#[cfg(feature = "fault-injection")]
+pub(crate) fn maybe_inject() {
+    if std::env::var_os("OWN_CLI_FAULT_PANIC").is_some() {
+        std::panic::panic_any("forced panic (fault-injection)");
+    }
+    if std::env::var_os("OWN_CLI_FAULT_ABORT").is_some() {
+        // A genuinely UNCATCHABLE termination: `catch_unwind` cannot see it and
+        // no hook runs. What the OS then reports (a SIGABRT on Unix, an abort
+        // status on Windows) is recorded by the note, never contracted.
+        std::process::abort();
+    }
+}
+
+/// The production build: nothing to inject, and nothing compiled in to inject
+/// it with.
+#[cfg(not(feature = "fault-injection"))]
+pub(crate) const fn maybe_inject() {}