Add the invariant lint that greps for the mistakes a compiler cannot see

[iderex]

The target gate runs a check reported as Enforce greppable invariants. It
catches the class of mistake that is invisible to a compiler and to a type
system, and obvious to a pattern: a call that must never appear, a construct that
was banned for a reason nobody remembers, a shape that was wrong once.

This is the cheapest check in a gate and the one most often left out, because
nothing forces it and its value only shows up the second time somebody makes the
same mistake.

What this produces

A rule set as data rather than as code, each rule carrying the failure it
prevents and, where one exists, the change that caused it to be written.

The first rules taken from decisions already made on this board: no direct
construction of a request outside the transport in #27, no direct filesystem
access outside the storage interface in #40, no drawing or platform type in the
public interface as decided in #3, no secret reaching a log as required by #71.

Each rule proven to bite by a fixture that violates it and reddens exactly that
rule.

Done when

The check runs on every pull request, every rule has a fixture proving it bites,
and a rule with no stated failure it prevents is refused by the check that loads
the rule set. Blocked on #17 and #80.

[iderex]

Two of the four seed rules listed here do not survive translation into a pattern in the shape the body describes. Both are cheaper to settle before the rule set is written than after, because a rule that cannot bite is indistinguishable from a rule that has nothing to bite on. Read at e5a513c23f9bc6a0ddedc7b52bb299ae5d0cee05.

The fourth seed is no secret reaching a log. There is no log. docs/decisions/0003-what-the-core-does-not-do.md refuses one by name:

git show origin/main:docs/decisions/0003-what-the-core-does-not-do.md | sed -n '127,133p'
### Diagnostics leave the core as events, not as text

The core produces diagnostic events with identities and fields. Where they go,
whether they are written down, and whether anything is shown to a person are the
client's, behind the interface in #100. A core that logs has chosen a destination
on a platform it does not know, and on a shared device it has written to a place
it cannot promise is private.

docs/decisions/0100-the-diagnostics-interface.md carries that to its shape, so the only thing a secret could reach is a field on an event handed to a client's sink:

git show origin/main:docs/decisions/0100-the-diagnostics-interface.md | sed -n '49,51p'
Fields, as name and value pairs of data. A count, an identifier, a duration, a
kind from 0004, an address. Not a rendered sentence, and not a sentence with
values already substituted into it.

A pattern looking for a call that writes a line therefore matches nothing and passes, which is the failure mode this issue's own opening paragraph is about. What docs/decisions/0071-what-may-leave-through-a-diagnostic-event.md refuses is a field rather than a call, and it decides per field name against the list in 0068:

git show origin/main:docs/decisions/0071-what-may-leave-through-a-diagnostic-event.md | sed -n '11,15p'
Redaction is decided per field name, by the core, before the client's sink is
called, against the personal data list in 0068 rather than against a copy of it;
each named field is excluded outright, reduced to a correlator that means nothing
outside the run that produced it, or carried whole, and which of the three it gets
does not vary with severity; an error returned to a caller in the same process is

Whether a field carries a secret is then a question about what it was classified as, and a pattern over source text does not answer it. A greppable rule can still be had on that surface, and it is a different rule from the seed: an event field that no classification names is the thing to refuse, since 0071 already excludes an unclassified field and a rule set could require every field name to appear in the list. #48 reads the same surface from the test side and lands in the same place.

The second seed is no direct filesystem access outside the storage interface in #40, and the exception in it is the hole. That interface is not implemented in this repository:

git show origin/main:docs/decisions/0040-the-cache-store-interface.md | sed -n '11,13p'
Cached bytes reach durable storage only through a store the client supplies, whose
whole surface is reading one entry, writing one entry, removing one entry and
saying how much it holds; every one of those is asynchronous, a read that finds

git show origin/main:docs/decisions/0068-the-data-locality-position.md | sed -n '94,96p'
The core writes nothing to a location it chose. Every byte goes through a store
the client supplied, which is #40 for the cache and #33 for the secret, so this
section is about what the core asks to be kept rather than about files it owns.

So there is no legitimate filesystem call site here at all, and the rule is both stronger and simpler than the seed: no filesystem access, with no exception for anything to sit inside. Written with the exception, a file opened in the core passes the check by being placed in whichever module the tree comes to call its storage, and nothing about that placement is visible to a compiler either.

The other two seeds hold as written. #27 owns request construction, and #3 refuses drawing and platform types in the public interface.

What this issue waits on is also narrower than the body reads. One of its two blockers is answered:

gh issue view 80 --repo Flowfin/core --json state --jq '.state'
CLOSED

git ls-tree -r --name-only origin/main -- docs/gate-parity.md
docs/gate-parity.md

What is left is #17 and, under it, a language, since a rule set as data is patterns over source and there is none:

git ls-tree -r --name-only origin/main | grep -Ev '^(\.github/|docs/)'
.gitattributes
DCO
NOTICE.md
README.md