fix: new --full scaffold passes own check; enforce documented naming rules (closes #442)

[0xLeif]

Root cause

specsync new --full produced a scaffold that failed its own check --strict, and the scaffolding commands accepted module names the docs forbid:

1. Missing required sections — the new template omitted Invariants, Behavioral Examples, and Error Cases, so generated specs immediately failed frontmatter/section validation.
2. Companion-marker warnings fired on drafts — validator.rs emitted "Unfilled companion scaffold marker" warnings for status: draft specs (7 warnings on a fresh new --full), and stub-section warnings also fired on drafts; drafts are scaffolds by definition, so both checks are now gated on non-draft status.
3. Greedy auto-detect — add-spec/scaffold silently claimed an arbitrary single source file when no module-matching file existed; they now warn loudly when falling back.
4. Name-validation gaps — 200-char names, reserved names (change, specs, Windows device names like con), spaces/leading-dash/emoji, and case-fold collisions (Lib vs lib) were accepted. Added validate_scaffold_module_name (strict: 1-64 chars, documented charset, reserved list) used by new/add-spec/scaffold/wizard, while validate_module_name keeps the base traversal-safety rules for internal callers (e.g. change.rs specs named "change"). Added check_case_collision.
5. Vague errors / undocumented rules — frontmatter errors are reported inline with specifics, and new --help now documents the naming rules.

Regression tests

• commands::tests::validate_scaffold_module_name_rejects_overlong
• commands::tests::validate_scaffold_module_name_rejects_reserved
• commands::tests::validate_scaffold_module_name_rejects_spaces_leading_dash_emoji
• commands::tests::case_collision_detects_case_fold_duplicates
• validator::tests::draft_specs_skip_companion_scaffold_markers

Verified end-to-end: new --full + check --strict exits 0 with 0 warnings.

File overlap note

src/cli.rs also carries the Init --repair flag belonging to #440 (same file, disjoint change); the #440 PR includes the identical cli.rs content.

⚠️ src/validator.rs is pending: it exceeded the MCP push size limit during publication and is being pushed to this branch separately (blob sha e996f84671e0723f71cbc44fe5b58c846e4a61cd). The branch does not compile until it lands.

Closes #442

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"Caw... your imports are all over the place."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	❌ failure
Dependency Audit	✅ Passed
Code Coverage	❌ failure
Format Check	❌ failure
Docs Site	✅ Passed
Spec Validation	❌ failure
Tests (build, test, clippy)	❌ failure
VS Code Extension	✅ Passed

---

_{Powered by corvid-pet}

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"Even the dumpster of code seems empty today."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	❌ failure
Dependency Audit	✅ Passed
Code Coverage	❌ failure
Format Check	❌ failure
Docs Site	✅ Passed
Spec Validation	❌ failure
Tests (build, test, clippy)	❌ failure
VS Code Extension	✅ Passed

---

_{Powered by corvid-pet}