Add metadata-only verify-write command

[andrei-hasna]

Summary

• add contracts verify-write <target> --authored <file> -- <fetch-command>
• verify fetched object identity before accessing stored content
• compare raw UTF-8 byte length and SHA-256 without rendering stored content or captured errors
• return fixed metadata-only MATCH, growth, shrink, mismatch, and refusal results

Verification

• focused: 8 pass, 0 fail, 42 expectations
• typecheck: rc 0
• full suite: 1412 pass, 7 skip, 0 fail, 13976 expectations
• build: rc 0
• staged secrets scan: rc 0, 39024 bytes scanned, 0 findings

Todos: d3e8319c-9c95-44c9-b8b2-20d12512295a
Review task: 6037c158-58ea-4cb6-a3a3-f57853e99fd4

This pull request is intentionally left unmerged for independent adversarial review and coordinator handoff.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #102 @ 8c35a5a — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

What I ran:

• bun install — exit 0; setup only; 23 packages installed.
• bun run typecheck — exit 0; 0 TypeScript errors/diagnostics.
• bun run test — exit 0; 1412 pass, 0 fail, 7 skip; 1419 tests across 62 files.
• Focused real CLI path: bun run src/cli/index.ts verify-write target-1 --authored LICENSE -- bun -e <fixture> — exit 0; MATCH — fetched object ID equals requested ID; 626 bytes; SHA-256 equal; stored body NOT rendered.
• git diff --check origin/main...HEAD — exit 0.

What I read:

• git log --oneline origin/main..HEAD and git diff origin/main...HEAD --stat against base 3052e0d.
• The full diff for all four changed files: src/cli/index.ts, src/cli/verify-write.ts, src/verify-write.ts, and tests/verify-write.test.ts.
• Surrounding command parsing and execution code in src/cli/index.ts, src/cli/read.ts, src/safe-read.ts, and src/safe-read-exec.ts, plus package.json and tsconfig.json.

Blocking P0/P1 findings: none. The fetch command is spawned from an argv array with shell: false; stdout and stderr are captured separately; the fetched object ID is validated before content comparison; mismatches fail closed; and neither payload nor digest is emitted.

Non-blocking follow-ups: none.