Add library-wide validation with deterministic JSON

[jon-devlapaz]

Problem

There is no strict validation command for the whole Tink library. tink skill list --library silently skips malformed or unreadable entries, while skillset listing is separate and human-oriented.

During the audit, 1,218 flat roots produced only 1,143 listed skills, with no explanation for omitted entries. External scripts had to reconstruct malformed roots, receipt state, provenance gaps, and name collisions.

Relevant code: src/library.rs, src/check.rs, src/skillsets.rs, and CLI dispatch in src/lib.rs.

Proposed change

Add:

tink library check [--strict] [--format text|json]

Build one typed report and render text or deterministic, versioned JSON from it. Report:

• valid standalone skills;
• valid skillsets and declared members;
• malformed, symlinked, unreadable, and orphan entries;
• missing or invalid skillset receipts;
• flat/member shadowing and cross-skillset name collisions;
• provenance state such as pinned, unrecorded, or invalid;
• stable sorted counts and paths.

Read-only commands should establish the JSON contract before mutation commands gain structured output.

Acceptance

• Malformed roots are reported rather than silently skipped.
• Cross-namespace collisions appear with both owners.
• JSON has a schemaVersion and stable sorted arrays.
• Text and JSON render the same underlying findings and counts.
• --strict returns non-zero for integrity failures.
• Existing list commands retain backward-compatible output.

Related

#18 covers a broader tink library list surface; this issue is specifically strict validation and machine-readable evidence.

Priority

P1 — operational integrity and auditability.