fix: honest init detection, --repair path, registry name escaping (closes #440)

[0xLeif]

Root cause

init / init-registry misreported or corrupted project state in five ways:

1. Dishonest detection — in an empty directory, init printed "Detected source directories: src" when nothing was detected. Added config::detect_source_dirs_with_confidence returning (dirs, actually_detected); init now says "No source directories detected — defaulted to source_dirs = ["src"]" and --json emits a detected boolean.
2. No repair path — deleting .specsync/version, .specsync/.gitignore, or sdd.json left the project broken; re-running init just said "already exists". Added init --repair: restores missing support files/dirs without touching the existing config, sanity-checks the config for a specs_dir key, and re-init now lists missing support files with a repair hint (text and JSON).
3. TOML injection via init-registry --name — a name containing " or newlines (e.g. evil"\n[specs]\npwned="x) produced invalid/injected registry TOML. generate_registry now TOML-escapes names and paths.
4. Empty --name "" accepted — now rejected with exit 1.
5. Nested .specsync in subdirectories — running init inside a subdirectory of an initialized project created a nested .specsync; find_initialized_ancestor now detects the ancestor project and errors out with guidance. Also init-registry now respects --json/--format.

Regression tests

• commands::init::tests::empty_dir_init_reports_fallback_not_detection
• commands::init::tests::repair_restores_deleted_support_files
• commands::init::tests::find_initialized_ancestor_detects_parent_project
• registry::tests::generate_registry_escapes_toml_injection

File overlap notes

• src/registry.rs is shared with Local registry parser silently misparses documented [[modules]] format and accepts malformed TOML #413 (disjoint regions: init/init-registry lie about detection and offer no repair path — fake source_dirs, TOML injection via --name, nested .specsync footgun #440 owns toml_escape/generate_registry, Local registry parser silently misparses documented [[modules]] format and accepts malformed TOML #413 owns parse_registry_toml); both PRs include the identical full file (blob 04c19b38…), so either merge order is clean.
• src/cli.rs is shared with new --full produces a scaffold that fails the tool's own validation (7 scaffold-marker errors, greedy auto-detect) #442 (identical content in both PRs).

⚠️ src/config.rs is pending: it exceeded the MCP push size limit during publication and is being pushed to this branch separately (blob sha a7c58f4a967906d238717757c13e620279d94367). The branch does not compile until it lands (detect_source_dirs_with_confidence is defined there).

Closes #440

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"Caw... your imports are all over the place."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	❌ failure
Dependency Audit	✅ Passed
Code Coverage	❌ failure
Format Check	❌ failure
Docs Site	✅ Passed
Spec Validation	❌ failure
Tests (build, test, clippy)	❌ failure
VS Code Extension	✅ Passed

---

_{Powered by corvid-pet}

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"I'm pecking through the errors..."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	❌ failure
Dependency Audit	✅ Passed
Code Coverage	❌ failure
Format Check	❌ failure
Docs Site	✅ Passed
Spec Validation	❌ failure
Tests (build, test, clippy)	❌ failure
VS Code Extension	✅ Passed

---

_{Powered by corvid-pet}