feat: align with CLI fleet standard

Validation errors now exit 7 as documented in JSON_SCHEMA.md (several
paths previously exited 2). A single render helper replaces ~62
duplicated JSON/table output blocks; the 1706-line cli.go is split by
command group. Adds the repo's first task runner (mise run check =
fmt+build+test+lint+conventions), release-please (replacing git-cliff),
dependabot, nfpm packages, and docs/adr/0002 recording the envelope and
exit-code contract. AGENTS.md moves to the fleet template with the
donor policy relocated to docs/donor-policy.md; .claude/skills and the
leaked .cursor lazyweb skill are removed; stale ROADMAP entries and the
duplicate docs/COMMANDS.md are cleaned up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: thedavidweng

.claude/skills/command-contract.md

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.cursor/skills/lazyweb/SKILL.md

@@ -11,4 +11,5 @@ jobs:
     uses: thedavidweng/cli-workflow-template/.github/workflows/go-ci.yml@main
     with:
       enable-coverage: true
+      enable-conventions: true
     secrets: inherit

.github/dependabot.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+        id: rp
+        with:
+          skip-github-release: true
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+
+      - name: Create GitHub Release
+        if: ${{ steps.rp.outputs.release_created == 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          TAG: ${{ steps.rp.outputs.tag_name }}
+        run: |
+          set -e
+          VERSION="${TAG#v}"
+          ESCAPED_VERSION=$(printf '%s' "${VERSION}" | sed 's/\./\\./g')
+          NOTES=''
+          if [ -f CHANGELOG.md ]; then
+            NOTES=$(awk "/^## \[${ESCAPED_VERSION}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md || true)
+          fi
+          INSTALL=$(cat <<'EOF'
+# Installation
+
+```bash
+# Homebrew (macOS)
+brew install --cask thedavidweng/tap/money
+
+# Go (cross-platform)
+go install github.com/thedavidweng/money/cmd/money@VERSION_PLACEHOLDER
+```
+EOF
+          )
+          INSTALL="${INSTALL/VERSION_PLACEHOLDER/$TAG}"
+          FULL_NOTES="${NOTES:-Release $TAG}
+
+${INSTALL}"
+          if gh release view "$TAG" &>/dev/null; then
+            gh release edit "$TAG" --notes "${FULL_NOTES}"
+          else
+            gh release create "$TAG" \
+              --title "$TAG" \
+              --notes "${FULL_NOTES}"
+          fi

.github/workflows/mirror.yml

@@ -28,6 +28,7 @@ website/dist/
 
 # Local test artifacts
 .playwright-mcp/
+.scratch/
 
 coverage.out
 *.test

.github/workflows/release-please.yml

@@ -1,17 +1,52 @@
 version: "2"
+
 linters:
+  default: none
   enable:
     - errcheck
     - govet
     - ineffassign
     - staticcheck
     - unused
+    - gocritic
     - misspell
+    - unconvert
+    - prealloc
+    - unparam
+    - godox
+    - whitespace
+    - nolintlint
+  settings:
+    errcheck:
+      check-type-assertions: true
+    gocritic:
+      enabled-tags:
+        - diagnostic
+        - performance
+        - style
+      disabled-checks:
+        - hugeParam
+        - rangeValCopy
+        - paramTypeCombine
+        - nestingReduce
+        - unnamedResult
+    misspell:
+      locale: US
+    nolintlint:
+      require-explanation: true
+      require-specific: true
   exclusions:
     presets:
       - std-error-handling
-    paths:
-      - third_party
-      - vendor
-      - testdata
-      - website
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/thedavidweng/money
+
+run:
+  timeout: 5m

.gitignore

@@ -25,6 +25,19 @@ archives:
       - goos: windows
         formats: [zip]
 
+nfpms:
+  - package_name: money
+    vendor: thedavidweng
+    maintainer: thedavidweng <noreply@github.com>
+    homepage: https://github.com/thedavidweng/money
+    description: "Local-first personal finance backend for agents and power users"
+    license: Apache-2.0
+    formats:
+      - deb
+      - rpm
+      - apk
+    bindir: /usr/bin
+
 checksum:
   name_template: "checksums.txt"
   algorithm: sha256
@@ -50,17 +63,7 @@ sboms:
       - "${artifact}.spdx.json"
 
 changelog:
-  sort: asc
-  filters:
-    exclude:
-      - "^docs:"
-      - "^test:"
-      - "^ci:"
-      - "^chore:"
-      - "^style:"
-      - "^refactor:"
-      - Merge pull request
-      - Merge branch
+  disable: true
 
 release:
   github:

.golangci.yml

@@ -0,0 +1 @@
+{ ".": "0.3.1" }