Redproof 0.12.0

Redproof turns a quality tool into a Gate: Rules, a Check that runs the real
tool, and Proofs that the Check catches the defect it claims to catch.

New Adapters

@redproof/knip turns unused code into a Gate. Seven Rules cover unused
files, exports, dependencies, development dependencies, undeclared
dependencies, unresolved imports, and duplicate exports. It runs Knip through a
bundled reporter, so the evidence is structured rather than parsed from text.

@redproof/istanbul turns test coverage into a Gate. nyc() collects
natively. istanbul() reads any producer of a full Istanbul coverage map, and
the repository proves that path with real c8. Four Rules cover statements,
branches, functions, and lines, each with a minimum percentage and optional
per-file enforcement. Counting, line semantics, and percentage truncation match
istanbul-lib-coverage exactly.

Both are first releases, so npm install finds them at 0.12.0.

Every Adapter now has a functional core

All six Adapter packages moved their decisions into src/core/ and their
effects into src/shell/ or the package entry point. Public exports did not
change.

Two dependency-cruiser rules enforce the split by path: an Adapter core cannot
import an effectful Node module, and it cannot import anything in its own
package outside src/core/. A third rule forbids one Adapter from importing
another. Each rule carries a proof that plants the violation and requires the
Gate to name it.

stryker() gained an optional second parameter, a mutation-run port. Existing
calls are unchanged. The port let five refusal paths gain end-to-end tests that
were previously unreachable.

New Rules

repository/lockfile-resolves-declared-optional-dependencies requires every
optional dependency a lockfile package declares to resolve to a lockfile entry.
A regenerated lockfile can silently drop the platform binaries for every
platform except the one that regenerated it. Nothing caught that before.

The self-hosted test-health Gate now collects {tests,packages/*/test}, the
same 86 files the test command runs. Thirteen package test files were read by
no Gate.

Fixes

• ESLint directive notices no longer refuse a healthy project.
• An allowed dependency-cruiser boundary disabled by allowedSeverity now
  REFUSES instead of passing silently.
• Stryker adapter reporting, dependency-cruiser evidence handling, and ESLint
  evidence handling are each hardened.
• Each published tarball is derived from the package it belongs to, so a
  per-package table can no longer pair a package with another package's
  tarball.
• Publishable Adapter source cannot import the test kit.
• npm publishing is resumable, and a new package's first publish explains its
  own bootstrap failure.

Verified

858 tests pass, 0 fail, 0 skipped. 6 Gates hold 38 Rules. 60 proofs established,
0 failed. All 8 packages pass clean-consumer verification at one shared version.