Layer the dev Runner (application service + boundary coercion)

[JPDuchesne]

Implements https://github.com/d3mlabs/plans/issues/37.

Requested by @JPDuchesne.

Closes d3mlabs/plans#37

[JPDuchesne]

Agent summary, recovered from the failed dispatch run (GitHub's 503 outage killed the run between the branch push and PR creation; this PR was created manually from the pushed branch with the body ai-flow would have posted):

---

RuboCop and srb tc are clean, and the suite runs 877 tests with 0 errors — the one remaining failure (Dev::BinDevTest#test_the_scrub_list_covers_every_key_the_running_bundler_exports) is a pre-existing environmental failure that was already failing before this work started: it asserts the test process itself was launched with BUNDLE_GEMFILE exported by bundler activation, which this harness doesn't do. It touches no file changed here.

What landed, per the issue's four PRs:

PR 1 — sealed hierarchy + service onion.src/dev/command.rb holds the sealed Command root with BuiltinCommand (abstract, open edge), ProjectCommand (renamed from ShellCommand), and OverriddenCommand; CommandRegistry, Config, and ConfigParser are deleted. Fourteen builtin classes live under src/dev/builtins/ with constructor-injected collaborators. CommandRepository (private constant, assembly only), CommandService (fetch → guard → execute → stamp), DependencyService (fronts Deps::Staleness with the warn-vs-CI-raise policy), and CommandExecutor (exhaustive case + T.absurd, wait-vs-exec derived from stamps?) form the onion; Runner shrank to usage check, context assembly, one service call, and the rescue-to-exit mapping. The any_instance purge is complete — zero occurrences remain in the suite; brew_integration_test.rb now stubs the instance in hand.

PR 2 — boundary coercion.ProjectManifest + ProjectManifestLoader: dev.yml parses once eagerly, dependencies.rb loads once lazily in run (a test proves dev --help never loads it, via a booby-trapped dependencies.rb), the removed ruby: key is rejected at parse time, and the rescue-to-nil fallback lives once in the loader with a warning test.

PR 3 — CLI shell.Cli::UsagePrinter and Cli::FlagParser extracted; flag parsing moved into CacheCommand/RunnerSetupCommand; exit-code mapping isolated in Runner#exit_for.

PR 4 — synchronizer.Synchronizer.for returns the real instance or UnconfiguredSynchronizer (sync no-op, sync! raises KnowledgeRepoNotConfiguredError); the constructor now requires its cache, and the nil-cache tri-state is gone.

One implementation note worth flagging for review: sorbet-runtime enforces sealing transitively at inheritance time (its inherited hook rides down to BuiltinCommand's subclasses and rejects them for lacking a sealed declaration), even though the static checker allows the issue's intended "sealed root, open abstract edge" shape. command.rb registers BuiltinCommand with an empty decl-file prefix to make the runtime match the static rule — commented in place, since it touches sorbet-runtime internals.

Tests mirror the structure: one file per builtin under test/dev/builtins/, plus command_service_test.rb, command_repository_test.rb (all three assembly branches + not-found), command_executor_test.rb (exhaustive dispatch, wait-vs-exec asserted at the Kernel.system/Kernel.exec boundary, including the dev#85 regression), project_manifest_loader_test.rb (absorbing the old config_parser_test.rb coverage), dependency_service_test.rb, the two CLI tests, and a runner_test.rb slimmed to usage wiring, context assembly, and error mapping. No commits were made, per the instructions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!