feature: deepen code smell and maintainability precision checks

[alxxjohn]

Summary

This branch deepens CodeGuard’s production-readiness and maintainability review coverage beyond baseline lint-style checks. It adds deterministic, multi-language detectors for structural code smells, naming/vocabulary drift, function responsibility quality, error contracts, defensive boundary handling, and remaining reliability parity gaps across Go, Python, TypeScript, JavaScript, and C++.

It also reconciles rule metadata, fix templates, profile/config behavior, docs, and the checks glossary so user-facing docs advertise shipped checks rather than roadmap-only ideas.

What changed

Reliability parity hardening

• Expanded parity for existing reliability rules across Python, TypeScript, JavaScript, and C++.
• Added/deepened detection for:
  • reliability.missing-cancellation
  • reliability.missing-graceful-shutdown
  • reliability.missing-concurrency-limit
  • reliability.resource-leak for TS/JS stream/file cleanup paths
  • reliability.missing-timeout for common C++ outbound dependency calls
  • reliability.swallowed-error for C++ catch blocks
  • reliability.lost-error-context across Python, TS, JS, and C++
• Added focused multi-language tests in tests/checks/reliability_multilang_test.go.

Structural smell rules

• Added structural smell detectors and scanner wiring for Go, Python, TypeScript, JavaScript, and C++.
• Added rule metadata and fix templates for:
  • smell.god-object
  • smell.feature-envy
  • smell.middle-man
  • smell.message-chain
  • smell.data-clump
  • smell.switch-on-type
• Added multi-language structural smell tests.
• Deferred smell.refused-bequest because reliable inheritance/no-op evidence needs stronger parser support to avoid noisy findings.

Naming and vocabulary precision

• Added/deepened naming precision checks:
  • naming.behavior-mismatch
  • naming.boolean-not-predicate
  • naming.domain-vocabulary-drift
  • naming.unknown-abbreviation
  • naming.cardinality-mismatch
  • naming.implementation-leak
  • naming.missing-unit
  • naming.role-suffix-overuse
  • naming.cross-layer-inconsistency
• Added optional repository glossary support through quality_rules.naming.glossary.
• Added config/defaults/validation and SDK aliases for naming configuration.

Function responsibility metrics

• Added/deepened function-level maintainability checks:
  • function.hidden-mutation
  • function.inconsistent-return-contract
  • function.multiple-responsibilities
  • function.orchestration-domain-mix
  • function.partial-result
• Kept existing function precision coverage integrated with the new responsibility metrics.

Error contract and defensive programming checks

• Added error-contract rules covering:
  • logged-and-returned / logged-and-ignored errors
  • lost context and generic messages
  • abstraction-level leaks
  • inconsistent wrapping
  • retryable/permanent distinction
  • user-facing internal leaks
  • hidden partial failures
  • ignored cleanup errors
  • panic/exception control-flow patterns
• Added defensive boundary/invariant checks covering:
  • unvalidated boundary input
  • invalid state representation
  • null assumptions
  • unchecked type assertions
  • unsafe numeric conversions / overflow
  • bounds assumptions
  • unsafe defaults
  • non-exhaustive branches
  • unchecked external responses
  • missing schema validation
  • missing resource limits
  • invalid state transitions
  • fail-open authorization
• Added multi-language tests for the error and defensive rule families.

Docs, metadata, and profile/config reconciliation

• Updated rule catalog metadata and fix templates for shipped smell, naming, function, error, defensive, maintainability, and reliability parity IDs.
• Updated docs/checks.md and docs/features.md so the shipped checks are visible and roadmap-only rules are not over-advertised.
• Added SDK metadata/profile/config tests, including naming glossary YAML/validation coverage.
• Updated the branch task board and removed completed old task boards.

Validation

Validation reported by the branch workers and final integration pass:

go test ./tests/checks -run Reliability
go test ./tests/cli -run Metadata
go test ./tests/checks ./tests/cli
go test ./tests/checks ./tests/cli ./internal/codeguard/config ./internal/codeguard/rules -count=1
make ci
make codeguard-ci
git diff --check

Final CodeGuard dogfood result:

• Code Quality: pass
• Performance: pass
• Design Patterns: pass
• CI/CD: pass
• Supply Chain: pass
• Agent Context: pass

Notes / deferred follow-up

• smell.refused-bequest remains deferred until inheritance/no-op detection can be made precise enough.
• Some checks are intentionally conservative static heuristics, not semantic proofs. Deeper future precision would benefit from richer type information, CFG/state-machine modeling, and stronger parser support.