feat(DEN-2725): route root gitops commands safely on current main

[ORESoftware]

Scope

Current-main root zed gitops dispatcher, replayed without changing its behavior after the independently certified offline tool-profile slice merged.

Exact parent:

de774cc9fc5b786d85e9b5ff19251675f0e9391b

Exact candidate head:

8eb8e31fe719ca598961a98bd139ef99ac905e8e

Behavior

• zed gitops ... delegates only to the trusted sibling executable zed-gitops next to the running zed binary.
• No ambient PATH search is used for the delegated command.
• Recursion into the same executable is rejected.
• Missing or non-executable sibling commands fail visibly.
• The child receives the caller's arguments and exit status without shell interpretation.
• Root help and shell completions advertise the command.
• The package graph validator and package manifest include the reviewed GitOps binary contract.

Changed files

• .zpkg.toml
• docs/gitops-validator.md
• scripts/validate-zed-package-graph.sh
• src/completion.rs
• src/external_subcommands.rs
• src/lib.rs
• src/main.rs
• tests/external_gitops_dispatch.rs

The only overlapping integration with the newly merged offline tool-profile slice is src/lib.rs. The current candidate preserves pub mod tool_profile; and adds only pub mod external_subcommands;. No task-runtime, inspect-JSON, SOPS ciphertext/configuration, native-registry, release, dependency, lockfile, tool-profile implementation, or workflow files are changed.

Validation

cargo fmt --all -- --check
cargo clippy --all-targets --all-features --locked -- -D warnings
cargo test --all-targets --all-features --locked
cargo test --locked --test external_gitops_dispatch
bash scripts/validate-zed-package-graph.sh

The focused integration test covers sibling selection, argument forwarding, exit-code propagation, missing executable behavior, recursion rejection, and root help/completion visibility.

Coordination and evidence

• supersedes stale feat(DEN-2725): route root gitops commands safely #233;
• two earlier semantic-identical candidate heads completed the entire 20-workflow product matrix successfully;
• permanent test-org exact-parent certification was merged through chore: sync Windows cfg hygiene into global package profiles #130 and pin-only recertification through feat(DEN-1462): export deterministic conflict-safe mise config #131;
• because offline tool profiles advanced main and overlapped src/lib.rs, this exact head is undergoing a fresh product matrix and a third pin-only canary update.

This PR remains draft until the new exact-head product and test-org matrices are terminal and review threads are clear.

[linear-code]

DEN-2725