feat(schema): type FallowOutput root enum, derive document-root oneOf from Rust (#384)

[BartWaardenburg]

Summary

Item 6 of the #384 schema-derive ladder: the document-root oneOf in docs/output-schema.json is now derived from a typed FallowOutput enum in crates/cli/src/output_envelope.rs, replacing the previously hand-maintained 12-entry block.

• 11 object-shaped envelope variants (AuditOutput, ExplainOutput, ReviewEnvelopeOutput, ReviewReconcileOutput, CoverageSetupOutput, ListBoundariesOutput, HealthOutput, DupesOutput, CheckGroupedOutput, CheckOutput, CombinedOutput) live behind #[serde(untagged)] so the wire stays byte-identical; consumers continue to narrow by unique field presence.
• CodeClimateOutput (bare-array form per the Code Climate / GitLab Code Quality spec) is excluded from FallowOutput and lives as a sibling root branch.
• CoverageAnalyzeOutput is hand-maintained pending #384 item 3c and tracked by a new HAND_MAINTAINED_ROOT_ENVELOPES constant plus hand_maintained_root_envelopes_appear_in_root_one_of drift test so it cannot silently disappear from the documented union.
• The regenerated TypeScript contracts (editors/vscode/src/generated/output-contract.d.ts, npm/fallow/types/output-contract.d.ts) now expose FallowOutput as a discriminated-union typename for downstream codegen consumers.

A future major release plans to add a top-level kind discriminator field for true O(1) narrowing on AI / agent consumers, paired with a one-cycle --legacy-envelope opt-out flag.

Design context

The discriminator question (untagged-now vs tagged-now) went through a 7-persona panel review. Verdict: ship untagged now, plan the tagged switch for the next major with an opt-out cycle. Untagged was the right call because (a) wire-shape change in a minor would burn renovate/CI users for a marginal narrowing win, (b) the maintainability win of retiring the hand-maintained root block is the real headline, (c) the planned future tag flip can land independently. The panel also caught that CodeClimateOutput cannot be a variant of any internally-tagged enum and CoverageAnalyzeOutput is a separate (item 3c) migration that should not be absorbed into this PR.

Variant order inside FallowOutput is most-specific first so a validator narrowing the oneOf does not match a CheckOutput payload against CombinedOutput first (CombinedOutput's required set is a strict subset of CheckOutput's).

Verification

• cargo test --workspace --all-targets (1471 + 437 + 290 + 154 + ... all pass)
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo clippy -p fallow-cli --features schema-emit --bin fallow-schema-emit --tests -- -D warnings clean
• cargo test -p fallow-cli --features schema-emit --bin fallow-schema-emit (9/9 drift tests, including 2 new)
• cargo fmt --all -- --check clean
• cargo doc --workspace --no-deps --document-private-items clean
• pnpm run codegen:types + pnpm run check:codegen + pnpm run lint clean in editors/vscode/
• python3 -c "from jsonschema import Draft7Validator; Draft7Validator.check_schema(json.load(open('docs/output-schema.json')))" clean
• Real-world wire validation: fallow check --format json against benchmarks/fixtures/real-world/preact validates against the regenerated schema with 0 errors
• OLD / NEW release binaries are hash-identical (the only Rust change is a #[derive]-only enum that is never constructed at runtime today)

Out-of-scope follow-up

AJV --strict=true flags one pre-existing strictRequired error on ContributorEntry.format (the field is in required but missing from properties). Exists identically on origin/main; not introduced by this PR.

Team review

Reviewer	Verdict	Notes
rust-reviewer	CONCERN	Stale doc comment + variant-order risk (both fixed in e3c05d3a)
json-output-reviewer	APPROVE	Pre-existing ContributorEntry.format AJV issue flagged as out-of-scope
cli-output-reviewer	CONCERN	4 prose polish items (all fixed in e3c05d3a)
vscode-reviewer	APPROVE	TS contracts compile, no breakage in extension consumers

Consensus: 2 APPROVE + 2 CONCERN, 0 BLOCKs. Both CONCERN reviewers' fixes applied in the follow-up commit.

🤖 Generated with Claude Code

[BartWaardenburg]

Codex's parallel /fallow-review on 30c0d849 caught a real BLOCKER my own review missed: the discriminator examples in the new prose (docs/output-schema.json root description, FallowOutput doc comment, CHANGELOG, backwards-compatibility) named report for health and groups for dupes. Both are wrong: HealthOutput and DupesOutput flatten their body via #[serde(flatten)], so the actual top-level keys are body fields like health_score (health) and clone_groups (dupes), not wrapper keys.

Fixed in 30c0d849 with correct discriminator field names across all four prose locations, plus a clarifying note that the two flattened envelopes carry the discriminator on body fields. Schema and TS contracts regenerated.

Also filed two follow-ups for pre-existing schema gaps surfaced during my self-review (both exist identically on origin/main, not introduced by this PR):

• schema: CloneGroup/CloneFamily require actions but runtime doesn't emit it on fallow dupes / combined output #393: CloneGroup/CloneFamily require actions but runtime doesn't emit it on dupes / combined output (234+608 ajv errors on vite)
• schema: ContributorEntry.format listed in required but missing from properties (ajv strictRequired) #394: ContributorEntry.format listed in required but missing from properties (ajv strictRequired)