feat(v0.1.2): behavioral check expansion + HelpOutput cache

[brettdavies]

Summary

Ships the three behavioral checks and shared HelpOutput cache promised for v0.1.2 H4:

• p1-flag-existence — second behavioral proof of p1-must-no-interactive alongside p1-non-interactive
• p1-env-hints — behavioral layer over source-only p1-env-flags-source
• p6-no-pager-behavioral — behavioral layer over source-only p6-no-pager

All three consume a single HelpOutput per target, so the binary's --help is spawned once per run regardless of how many checks inspect it. Each check declares covers() against an existing registry ID — no new requirement IDs land in this PR, only new verifiers. Three requirements move from single-layer to dual-layer coverage (dual-layer count: 4 → 7).

Also carries an unrelated chore: raising required_approving_review_count from 0 → 1 on the main branch ruleset, committed as the first commit of the branch.

Changelog

Added

• Add p1-flag-existence behavioral check — passes when --help advertises a non-interactive gate flag (--no-interactive, --batch, --headless, -y, --yes, -p, --print, --no-input, --assume-yes). Skips when the target already satisfies P1 via help-on-bare-invocation or stdin-primary.
• Add p1-env-hints behavioral check — passes when --help exposes clap-style [env: FOO] bindings for flags. Emits medium confidence; the heuristic covers the canonical but not the only env-binding format.
• Add p6-no-pager-behavioral behavioral check — passes when --no-pager is advertised in --help. Skips when no pager signal (less / more / $PAGER / --pager) appears. Emits medium confidence.
• Add confidence field to every scorecard result (high / medium / low). Additive; v1.1 consumers feature-detect.
• Add dual_layer count to the coverage matrix summary so the headline prose surfaces how many covered requirements have verifiers in two layers.

Changed

• Raise required approving review count on main branch from 0 to 1.

Documentation

• Regenerate docs/coverage-matrix.md + coverage/matrix.json to pick up the three new behavioral verifiers.

Type of Change

• `feat`: New feature (non-breaking change which adds functionality)

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing completed
• All tests passing

Test Summary:

• Unit + integration tests: 41 passing (up from 35 — 6 tests added for the new checks, plus additional HelpOutput parser coverage).
• Pre-push hook (mirrors CI): fmt, clippy -Dwarnings, test, cargo-deny, Windows compat — all green.
• Smoke-tested against rg, bat, bird, xr via anc check --command; all new checks produce sensible verdicts.
• Dogfood: anc check . on the agentnative repo produces Pass or Skip (no Warn) for all three new checks.

Files Modified

Created:

• src/runner/help_probe.rs — HelpOutput cache with lazy flags(), env_hints(), subcommands() parsers.
• src/checks/behavioral/flag_existence.rs
• src/checks/behavioral/env_hints.rs
• src/checks/behavioral/no_pager_behavioral.rs

Modified:

• src/runner.rs → src/runner/mod.rs (promoted to a module directory so help_probe can live alongside BinaryRunner).
• src/project.rs — lazy help_output() accessor on Project (OnceLock, same pattern as parsed_files).
• src/types.rs — Confidence enum + CheckResult::confidence field.
• src/scorecard.rs — serialize confidence on every result view.
• src/principles/matrix.rs — dual_layer stat + surfaced in summary prose.
• src/checks/behavioral/mod.rs — register the three new checks.
• docs/coverage-matrix.md + coverage/matrix.json — regenerated.
• .github/rulesets/protect-main.json — raise required approving review count on main.
• 34 existing check files gain confidence: Confidence::High, in their CheckResult construction — mechanical, no semantic change.

Key Features

• One --help probe per target regardless of how many checks consume it. Runner caching means p1-flag-existence and p6-no-pager-behavioral share state without explicit plumbing.
• Dual-layer coverage growth: three requirements now have both behavioral and source/project verifiers, halving the single-layer bucket for P1 and P6 MUSTs.

Breaking Changes

• No breaking changes

Deployment Notes

• Post-merge, regenerate the 10 committed scorecards on agentnative-site (H3's proven workflow) once v0.1.2 is released to crates.io + Homebrew. Matrix sync (scripts/sync-coverage-matrix.sh) picks up the new dual_layer field automatically.

Checklist

• Code follows project conventions and style guidelines
• Commit messages follow Conventional Commits
• Self-review of code completed
• Tests added/updated and passing
• No new warnings or errors introduced
• Changes are backward compatible