fix: propagate sidecar errors + reseal recovery subcommand (Refs #118)

[noahgift]

Summary

Closes #118. Two related defects in state integrity handling.

Defect 1 — silent sidecar-write error

src/core/state/mod.rs:57,108:

let _ = integrity::write_b3_sidecar(&path);

After save_lock atomically renamed state.lock.yaml.tmp → state.lock.yaml, the sidecar's Result was discarded. If the sidecar write failed (disk full, fs hiccup, permission, signal, race with reaper), the apply reported success, but on-disk state was lock.yaml (new) + .b3 (stale or missing). Next apply hard-failed:

ERROR: integrity check failed for state/<m>/state.lock.yaml:
       expected <old>, got <new>

Toyota Way violation: defect propagated silently across time — no signal at the moment of corruption.

Fix: propagate with ?; error message points users to the new forjar reseal subcommand.

Defect 2 — no recovery path for pre-existing drift

Users with drift from OLD forjar versions (or from git checkout/merge that restored lock.yaml without .b3) had no recovery short of forjar apply --yes. Adds a reseal subcommand that rewrites sidecars from current lock contents WITHOUT converging infrastructure:

forjar reseal --all              # reseal every state/*/lock.yaml + global
forjar reseal --file <path>      # one specific lock file
forjar reseal --machine <name>   # single machine
forjar reseal --all --dry-run    # preview

Safety: each target is YAML-parsed before its sidecar is rewritten. A malformed lock file is rejected ("<path> is not valid YAML") so reseal cannot bless a corrupt file and have next-apply silently trust garbage.

Files

• src/core/state/mod.rs — ? propagation in save_lock + save_global_lock
• src/cli/reseal.rs (NEW, TDG 97.5/100 A-) — 4 small fns
• src/cli/mod.rs — register mod reseal
• src/cli/commands/{mod,state_args}.rs — Commands::Reseal(ResealArgs)
• src/cli/dispatch_misc.rs — dispatch to reseal::cmd_reseal

Test

Smoke-tested against real drift on paiml/infra state dir: 13/24 lock files mismatched → apply correctly rejected. reseal --all resealed 23 files with 0 failures; next apply proceeded past the integrity gate. End-to-end fix confirmed on live state.

TDG: src/cli/infra.rs unchanged (89.1/100 A- baseline). New src/cli/reseal.rs 97.5/100 A-.

Related

• paiml/infra#77 ANDON — aprender 11-PR stack blocked; hit this bug trying to forjar apply the companion fix paiml/infra#78.
• aprender#1043 — ci.yml per-PR cargo mount (workspace-test now PASS on new mount).

🤖 Generated with Claude Code