[BUG] [Medium] findProjectRoot silently walks past invalid local lessonkit.json

[eddiethedean]

Description

findProjectRoot() treats structurally invalid local lessonkit.json files as non-existent and continues walking up the directory tree. A nested folder with a broken manifest silently resolves to a parent project without error.

Affected Components

• packages/cli/src/lib/project.ts — isProjectManifest() (lines ~27–40), findProjectRoot() (lines ~42–50)

Steps to Reproduce

1. Create structure:

   parent/lessonkit.json          # valid manifest
   parent/sub/lessonkit.json      # { "schemaVersion": 1, "name": "bad" } — missing course
   

2. cd parent/sub && lessonkit build
3. CLI uses parent/ manifest silently; no error about invalid local manifest.

Expected Behavior

When lessonkit.json exists in cwd or ancestor but fails structural validation, CLI should error with a clear message rather than skip silently.

Actual Behavior

isProjectManifest() returns false; walk continues upward to parent valid manifest.

Root Cause Analysis

if (existsSync(configPath) && isProjectManifest(configPath)) {
  return dir;
}
// invalid local manifest: exists but fails check — skipped with no warning

Impact

• User impact: Edits to wrong manifest in monorepos/nested folders; confusing build output.
• Data impact: Packages wrong course descriptor.
• Production risk: Medium for nested project layouts.

Suggested Fix

If lessonkit.json exists but fails isProjectManifest, throw CliError with validation hint instead of continuing walk (or only continue if explicitly configured).

Test Coverage Gaps

packages/cli/test/cli.test.ts tests skip when course is array; no test for invalid local + valid parent.

Severity

Medium

Confidence

High