Make HookCommand enforce its non-empty invariant

[errfld]

Summary

Complete the HookCommand type boundary so invalid empty commands cannot be constructed as accepted domain values, and remove the duplicate scheduler fallback check.

Concrete file/function evidence

• crates/git-smee-core/src/config.rs:131-142 defines HookCommand(String) with a private field, but public infallible From<String> and From<&str> implementations at :148-157 still allow HookCommand::from("") and whitespace-only values.
• HookCommand::is_empty at crates/git-smee-core/src/config.rs:138 exposes validation as a query rather than enforcing the invariant at construction/deserialization.
• SmeeConfig::validate at crates/git-smee-core/src/config.rs:69-87 checks each command after TOML deserialization.
• crates/git-smee-core/src/executor/scheduler.rs:145 checks command.is_empty() again, so execution still treats an accepted HookCommand as potentially invalid.
• This is a focused follow-up to the typed boundary introduced in Introduce a typed hook-command execution boundary #185; the type now flows through scheduler/runner APIs, but the non-empty invariant still has multiple owners.

Architectural concern

A domain type named HookCommand suggests callers can rely on its invariant, but public construction currently accepts values that configuration validation and execution reject. This leaves invalid states representable and couples the scheduler to config-validation policy. Future constructors or programmatic users can bypass SmeeConfig::from_toml and discover the error only during execution.

Proposed direction

Introduce a fallible constructor (HookCommand::new / TryFrom<String>) that trims only for validation while preserving the exact shell source. Use custom Serde deserialization or a validated wire-to-domain conversion so TOML parsing produces only valid HookCommand values. Remove or restrict the infallible conversions, then remove the scheduler's empty-command branch. Preserve the TOML shape and exact command bytes for valid inputs.

Acceptance criteria

• Public construction and deserialization cannot produce an empty or whitespace-only HookCommand.
• The exact non-empty shell source is preserved; this issue does not normalize command contents.
• Empty-command validation has one owner and reports the existing actionable hook/entry context (or an equivalently specific typed error).
• executor/scheduler.rs no longer re-checks an invariant guaranteed by HookCommand.
• Existing TOML format and valid command execution remain compatible.

Validation expectations

• Run cargo fmt --all -- --check.
• Run cargo clippy --workspace --all-targets --all-features -- -D warnings.
• Run cargo test --workspace --all-targets --all-features.
• Add focused tests for empty and whitespace-only TOML commands, programmatic construction, exact shell-source preservation, and a normal execution path.

[errfld]

Implementation update for #191

Summary of changes

• Added fallible TryFrom<String> / TryFrom<&str> construction for HookCommand; empty and whitespace-only source is rejected while valid source is preserved byte-for-byte.
• Added a validated TOML wire-to-domain conversion that reports the existing hook name and entry index context.
• Removed the scheduler's redundant empty-command check and NoCommandDefined execution fallback.
• Migrated programmatic call sites and public examples to fallible construction.

Preflight knowledge checks

• Memory search run: no matching memory issues.
• Decision search run: no matching decision issues.
• Blocker/parent/linked issues reviewed: no blockers/parents; reviewed predecessor Introduce a typed hook-command execution boundary #185.
• Prior task notes reviewed: read Introduce a typed hook-command execution boundary #185 implementation and merge notes.

Validation

• RED tests: constructor and direct TOML deserialization regressions failed against origin/main for the expected accepted-invalid-value behavior.
• Tests run: cargo test --workspace --all-targets --all-features (17 CLI unit, 86 CLI integration, 92 core unit, 11 config integration, 28 installer integration; all passed).
• Static checks: cargo fmt --all -- --check; cargo clippy --workspace --all-targets --all-features -- -D warnings.
• Manual checks: reviewed the final diff; git diff --check passed; searched for stale HookCommand::from, command .into(), NoCommandDefined, and command emptiness checks (none remain).

Learnings

• Custom HookCommand deserialization alone loses hook/entry context in TOML errors. Converting a private SmeeConfigWire at the aggregate boundary preserves contextual diagnostics while ensuring the public domain graph contains only validated commands.

Follow-ups

• None identified; the issue is fully covered by PR Enforce HookCommand's non-empty invariant #192.

References

• PR: Enforce HookCommand's non-empty invariant #192
• Commit: e9a5a36

[errfld]

Merge completion

PR #192 was squash-merged as a7a848578643b4bd866fd21532988e79c3a6d282 after all hosted checks passed and CodeRabbit approved the final head.

Completed behavior:

• HookCommand rejects empty/whitespace-only values at public construction and deserialization.
• Valid shell source is preserved exactly.
• TOML conversion retains actionable hook/entry context.
• Scheduler no longer re-checks command emptiness or exposes NoCommandDefined.
• The review-requested no-allocation error path was fixed in 331acfb and acknowledged in-thread.

Final merged-default validation:

• cargo audit passed (two repository-allowed git2 warnings remain).
• cargo fmt --all -- --check passed.
• cargo clippy --workspace --all-targets --all-features -- -D warnings passed.
• cargo test --workspace --all-targets --all-features passed: 17 CLI unit, 86 CLI integration, 92 core unit, 11 config integration, and 28 installer integration tests.
• Main is clean and aligned with origin/main.

Issue is closed with status:done.