chore: a readable version, a readable run, and one subject per file

[ttncode]

What this changes

Three things from the review that were left over. None blocked using the toolbox; all three were paid for on every use.

1. A version people can read. git tag returned nothing, so scaffold --version answered with a bare sha and every .scaffold.toml recorded one. CONTRIBUTING now says when a tag is cut and why tagging stays manual: there is no package to publish, and what a tag buys is a readable answer in --version and in every manifest written after it — not a distribution channel. v0.1.0 gets tagged on merge.

2. A readable run. scaffold new handed the terminal several minutes of a package manager's progress bars, through which the one line that mattered — which application is being generated — never appeared at all. It now prints this:

→ generating apps/api with nestjs (a framework generator, this takes a few minutes)
→ configuring apps/api
→ wiring postgres into api
→ reconciling the workspace lockfile
→ checking quiet-demo's lockfile against the supply-chain policy
→ locking the toolchain and committing

created …/quiet-demo

next:
  cd …/quiet-demo
  mise install && mise exec -- lefthook install
  scaffold publish              # create its GitHub repository
  mise run checklist            # what CI will run

The technique is pnpm_install's, which has captured its own output and shown it only on failure since it was written; run_quietly is that, named, so the adapter generators, post-generate hooks and service drivers can use it too. A failing step still prints everything — there is a test for exactly that, because hiding output is only acceptable if failure shows all of it. SCAFFOLD_VERBOSE=1 passes output through for a run that hangs rather than fails, where there is otherwise nothing to look at.

3. One subject per file. lib/project.sh carried the pnpm workspace, ADR-0017's supply-chain policy, the config_roots manifest, the GitHub account, the project name rule and the git commit — 545 lines whose only relation was being needed by scaffold new.

• lib/pnpm.sh — the workspace and the policy
• lib/manifest.sh — config_roots, the CI matrix derived from it, the build targets derived from the applications
• lib/project.sh — what a project is made of and how it is finished, now 264 lines

cmd_new's all-typescript/mixed branch becomes join_typescript_workspace and keep_apps_standalone. It was an if/else long enough that the condition and its consequence never appeared on screen together; the decision is eleven lines now.

One detail worth the reviewer's eye: the pair passed to those two functions is <rel>:<adapter>, not just the path, because the second branch asks the adapter whether it is TypeScript. "Does it have a package.json" is a different question with a different answer — laravel-inertia has one, for vite, and is not TypeScript — and substituting it would have been a silent behaviour change inside a refactor.

How it was verified

• No behaviour change intended in (3), so both branches were generated end to end before and after: an all-TypeScript project (packages/types joined, per-app lockfiles gone, two images built from context .) and a single-adapter one.
• Every test site that sourced lib/project.sh for a moved function now sources the file that has it, rather than project.sh quietly re-exporting its siblings — the dependency is the point of the split.
• Capturing the output broke three tests that were reading the old invocation text rather than the guarantee behind it. They now assert the guarantee: cli.bats checks the negative too (no value handed to a shell directly, one script runs both through mise exec), and service.bats checks that a driver failure names the service and the family, which is the actual requirement — a bare "a driver failed" sends the reader to the wrong one of eight.
• mise run lint and mise run test-unit green locally; the lanes run here.

Checklist

• mise run lint passes
• mise run test-runner passes
• New behaviour has a test that fails without the change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes