refactor(cli): simplify semantic validator and remove legacy commands

[jrepp]

Summary

Retire legacy CLI-only surface that duplicated runtime/automation paths now owned elsewhere, and simplify ScriptSemanticValidator to a conservative, context-free set of checks. Net −1160 lines across HypeCLI.swift and HypeCLITests.swift.

Context

The CLI grew several diagnostic/import entrypoints that overlapped with capabilities already living in HypeCore and driven by the app/debug server. They were exercised only by CLI tests and added maintenance cost (and a tangle of effectiveCardId / message-path flow analysis in the semantic validator that produced noisy, hard-to-reason-about findings). This PR removes the dead CLI surface and simplifies the validator while preserving every runtime caller.

Rebased onto main (the prior base docs/architecture-update landed as #284; those two commits dropped out of this branch during rebase, leaving a single clean commit).

Changes Made

Removed CLI options (Sources/HypeCLI/HypeCLI.swift):

• --import-stackimport-project plus its sub-options --loose-media-manifest, --loose-media-source-root, --loose-media-replacement-root, --loose-media-names, --loose-media-aliases-json, --stack-library-json, --used-stack-aliases, --no-replace-existing-project-output. Project import still runs via StackImportPackageProjectImporter (used by HypeDebugServer and HypeCore/MystStackImportAcceptanceTests).
• --validate-package. SQLite package validation still runs via HypeSQLiteStackStore.validate(packageURL:) (used by TargetRuntimePackageBuilder and persistence tests).
• --parse-only flag (unused).
• Corresponding private helpers (runImportStackImportProject, validatePackageFile, JSON/CSV decoders, PackageValidationReport, ProjectImportOutput) and the mutual-exclusion validators in validate().

Simplified ScriptSemanticValidator (Sources/HypeCLI/HypeCLI.swift):

• Dropped card-context flow analysis (statementsIssuesAcrossCardContexts, localHandlerCallCardContexts, validationCardContexts).
• Dropped static navigation-target tracking and go-statement card-context propagation through statementIssues / statementsIssues.
• Dropped legacyCardId resolution, currentStackLibraryEntry, resolveLocalLegacyCardId, staticNavigationTarget.
• Dropped message-path function-handler lookup (functionHandlerInMessagePath, messagePathScripts).
• Dropped imported background stack-lifecycle and button/field pass-through hook exceptions; hooks are now checked uniformly via allowedHooks(for:).
• expressionIssues / statementIssues no longer thread messageNames or effectiveCardId; bare-handler-call findings reintroduced as a direct messageNames check.
• Consolidated staticLiteralString → staticString, added staticObjectReferenceName and staticSoundName helpers, and stackLibraryHasCardReference → stackLibraryContainsCard.
• Removed "id" from knownBuiltInFunctions and trimmed stackHooks to the dispatched set.

Tests (Tests/HypeCLITests/HypeCLITests.swift): removed the suites covering the retired options; kept the 34 remaining CLI integration tests (arithmetic, chunks, import-summary/output-package/corpus, validate-scripts semantics, benchmark columns, inference smoke).

Testing & Verification

• Ran relevant automated tests: swift test --filter HypeCLITests → 34/34 passed in a clean worktree rebased on origin/main.
• Built the HypeCLI target: swift build --target HypeCLI → clean.
• Confirmed no lingering references to removed flags (--import-stackimport-project, --validate-package, --loose-media-*, --parse-only) outside the deleted code. The underlying StackImportPackageProjectImporter and HypeSQLiteStackStore.validate(packageURL:) APIs remain in HypeCore and are still exercised by HypeDebugServer, TargetRuntimePackageBuilder, and HypeCore tests.
• No persistence / network / keychain / script-execution behavior change — pure CLI + validator simplification.

Screenshots / GIFs

N/A — no UI change.

Checklist

• I read the relevant parts of architecture.md and decisions.md.
• I considered persistence, network, keychain, file-system, script-execution, and AI-tool safety risks (none introduced; CLI surface removal only).
• I added or updated tests, or explained why tests are not needed (removed suites tracked the removed options; remaining 34 tests cover retained behavior).
• I updated documentation for behavior, setup, architecture, persistence, or workflow changes (no doc change required — these flags were undocumented in README.md / architecture.md; the underlying APIs remain).
• I did not stage or rewrite .hype stack documents.
• I noted any follow-up work or known limitations: the semantic validator is now more conservative and may emit findings previously suppressed by card-context/message-path analysis; downstream stacks should re-run --validate-scripts to capture the new baseline.

---

Diff scope: 2 files, +153 / −1313. Build: ✓. Tests: 34/34 ✓.