perf(gate): spawn secretlint/madge once per gate — ~47% faster pre-commit (closes #211)

[yuyu04]

Summary

A gate-scoped memo makes the two shell-out detectors — HARDCODED_SECRET (secretlint) and ARCHITECTURE_VIOLATION (madge) — spawn their external tool once per gate instead of twice, the dedup secret.ts already documented but never enforced. Closes #211.

Why (measured, not assumed)

Per-detector profiling on cladding's own repo:

HARDCODED_SECRET       4425 ms   (secretlint)   ┐ together ~97% of the
ARCHITECTURE_VIOLATION 1406 ms   (madge)        ┘ drift stage
every other detector    < 60 ms

They run in the Drift stage (which sweeps all detectors) AND again as the dedicated Secret/Arch stage → 2× spawn = ~5.8s duplicated per gate.

An earlier hypothesis (caching the detectors' file-walk) was dropped after profiling — the file-walking detectors total <30 ms, so that idea was negligible. Following the measurement led here instead.

What's in the box

• src/stages/scanner-cache.ts (new) — primeScannerCache(on) + memoizeScan(key, compute), mirroring the run-scoped spec cache (F-cd0415). A fresh Map per primed gate; pass-through when unprimed.
• hardcoded-secret.ts / architecture-violation.ts — route their execaSync through memoizeScan, keyed by (cwd, cmd, args).
• clad.ts — primes the memo around the stage loop, clears in a finally (the long-lived MCP server must not carry a scan across runs).
• secret.ts — comment updated: the "avoids spawning twice" promise is now actually enforced.
• Lives in src/stages/ (NOT detectors/) so the 38-detector count is unchanged.

A/B (isolated worktrees, 3 runs each)

clad check --tier=pre-commit	time
develop (spawn ×2)	11.7 / 11.9 / 12.3 s
this PR (spawn ×1)	6.3 / 6.3 / 6.4 s
delta	~−47%

Correctness: the HARDCODED_SECRET / ARCHITECTURE_VIOLATION findings are identical — the memo returns the same result, just once (proven by the unit test returning the same reference; the only OLD↔branch JSON diffs are unrelated branch state — a new feature shard + pre-attestation, not scanner findings).

Scope / safety

• Pass-through when unprimed → standalone detector calls and the MCP read path are byte-for-byte unchanged.
• Cleared in finally → each gate run gets a fresh cache; no stale cross-run scans in the MCP server.

Feature cycle

spec/features/gate-scanner-memo-5a49899e.yaml (F-5a49899e, 4 ACs) → implement → blind tests (tests/stages/scanner-cache.test.ts, 6) → clad done GREEN. Single clean commit on develop.

🤖 Generated with Claude Code