feat(topology): recover complexity per sub-package with per-child engine routing

[maudlin]

What

The last whole-tree measurement arm. On an undeclared fan-out, complexity ran once over the whole tree, routed by whole-tree engine selection. This recovers it per assessment root, with the full engine ladder re-routed per child (route_complexity_child, a scoped mirror of the whole-tree routing):

• ESLint on the JS/TS slice, using the child's own flat config + local bin;
• lizard on the non-JS slice (inventory sliced to the subtree via inventory_paths_under);
• scc fallback (keep-set sliced via scc_keep_for_root).

Findings are namespaced (backend/complexity) and labelled per package (📦 Sub-package: …).

git-hotspots CSV stays whole-tree. The single complexity-full.csv is accumulated across packages — truncated once before the loop, appended per arm, always in TARGET-relative (namespaced) paths (scc/lizard/eslint findings re-prefixed; the standalone-lizard CSV's file column namespaced via awk) — so the churn × complexity join keeps working. If nothing is measured, the empty CSV is dropped to match the pre-#78 absent state exactly.

One honest note: a fan-out child lacking its own eslint flat config reports its JS/TS complexity as unmeasured (rather than borrowing a root config) — strictly more honest than today's single-engine-for-the-whole-fanout behaviour.

Why this is safe

Single package / declared workspace → one iteration at . reusing the whole-tree routing, no cd, SLUG_NS empty, $PWD == $TARGET, ns="" → byte-identical to before (the gate).

Verification

• Full CI suite green locally (12 suites).
• Byte-identical on single-package fixtures across all three arms — lizard (Go), scc (Classic-ASP-only), merged (node/TS) — diffing the complexity record, complexity-full.csv, and console; plus a full parsed-set diff (all records identical bar the CHECKUP_OUT_DIR path in one git-hotspots message). The empty-vs-absent CSV edge is normalised so even the filesystem matches.
• Fan-out smoke: a Go-dominant child and a Python-dominant child (both node packages) each route to lizard per child → proc/complexity + svc/complexity records, and complexity-full.csv accumulates namespaced rows (proc/job.py, svc/server.go).

Completes #78

With stats (#121), duplication (#122) and now complexity, every measurement arm recovers per sub-package. The eslint/lizard/scc arms, the duplication engines, and the scc-based stats all honour the detected topology.

Closes #78

🤖 Generated with Claude Code