fix(cli): cli-3.15.0 — idempotent injection + host marker-health validation

[montfort]

Summary

• Fixes the duplicated <!-- straymark:end --> accumulation in .cursorrules (and other host files) reported in Sentinel after straymark update-framework. Root cause: STRAYMARK.md documents the marker convention by embedding the literal strings <!-- straymark:begin --> and <!-- straymark:end --> inside a fenced code block; the old replace_between_markers called find(MARKER_END) and stopped at that in-docs literal, truncating the canonical block mid-embed and dropping the real END as an orphan one extra end marker per update.
• inject::find_canonical_block switches to first-BEGIN/last-END semantics (rfind(MARKER_END)) so the canonical span survives marker literals embedded in the payload. inject_directive now auto-sanitizes orphan markers and pathological double-block corruption on the next re-injection via a new sanitize_orphan_markers helper.
• Adds inject::MarkerHealth + inject::inspect_marker_health and a new host-marker-health rule to straymark validate that walks manifest.injections and warns about malformed host files before the operator re-runs an update.

Why minor (3.15.0)

validate gains a new observable signal (host-marker-health warnings), so per the project convention this is a minor bump rather than a patch.

Test plan

• cargo test — 320 unit tests + 21 integration binaries pass (10 new tests cover Sentinel reproductions: orphan-end-before-begin, two complete blocks, orphan-begin-no-end, idempotency, end-to-end .cursorrules repair via the public API, healthy-with-marker-literals-in-embed).
• E2E reproduction in a sandbox: straymark init, corrupt .cursorrules by appending an extra <!-- straymark:end -->, run straymark validate → warns under host-marker-health (2 begin / 3 end marker(s)); run straymark update-framework (with the local checksums version downgraded to force the update path) → file restored to a single canonical pair; straymark validate afterwards is clean.
• Idempotency: two consecutive update-framework runs produce byte-identical .cursorrules (diff exit 0).
• No false positive: a freshly-init'd .cursorrules (which contains 2 BEGINS and 2 ENDS because STRAYMARK.md describes the markers in its own docs) is not flagged as malformed.
• Reviewer: confirm tag flow — after merge, push cli-3.15.0 (no framework bump; fw-4.17.0 stays current).

Adopter guidance

Run straymark update-cli after release to install cli-3.15.0. The next straymark update-framework auto-repairs any host file that drifted into a malformed-marker state. Adopters who want a heads-up before re-running the update can call straymark validate now; malformed host files appear under the host-marker-health rule.

🤖 Generated with Claude Code