v0.3.0

Tighten both pipelines' contracts (#3)

# Summary

Every step now says exactly what it does — checks are commands, trust is
never implicit, and destructive consent has one honest name per family.

**A validate step of its own.** `refactor verify --validate` bundled two
unrelated questions behind one flag. Now **`refactor validate`** (new)
runs the engine's own check (`init -backend=false` + `validate`) on
every written module directory — needs `--engine`, no credentials — and
the bare pipeline runs it inline when `--engine` is given, otherwise
printing how to run it. **`refactor diff`** (renamed from `verify`)
stays the provenance gate, with `diff(1)`'s exit semantics; it compares
files and never asks the engine. The rename frees `verify` to mean one
thing: the migrate family's judgment.

**`refactor run` owns its target directories.** They must not exist, or
`--overwrite` deletes them entirely (with a loud warning) and rewrites
from scratch; `refactor map` no longer checks existence at all.
Hand-added files never survive a run, which retires the
copy-then-run-again workaround for path-relative file reads — the one
handling is now the restructure LIMITATIONS.md always recommended (file
content through a variable), and the showcase monolith is restructured
accordingly.

**The state split is always re-derived.** `migrate map` no longer trusts
leftovers (the receipt short-circuit and resume machinery are deleted):
every run pulls the monolith's state fresh and re-executes the whole
split, noting modules whose previous carve was already correct. A
crashed run is retried by just re-running, correct by construction.

**Drift is out of scope.** `--refresh` is removed and no step refreshes,
`migrate verify` included: the pipeline proves the migration's fidelity
to the pulled state; reality is the prerequisite clean monolith plan
before, and the control plane's plans after adoption. The one exception
— data sources are read live in every plan — is named up front by a
per-module **Live reads** listing in prove and verify.

**Receipts are the machine interface.** `--output json` is removed
everywhere; stdout is for people, machines read the exit code and the
yaml receipts.

**One destructive flag name per family.** `migrate run --overwrite` →
`--force` (it is `state push -force`); `--overwrite` now exists only on
the refactor side, where overwriting directories is literally what it
does.

Also in this branch: the README documents the unproven path (every check
declined, and what that costs — the proofs also materialize the tfvars
artifacts); the report output is polished (spacing, colors, verdict
wording); and test scratch output (`testdata/*/out/`, wiped and
regenerated per run) is untracked and gitignored — fixtures stay in
`testdata/*/in/`.

# Version

+semver: minor

# Release Notes

<!-- release-notes -->
Every step's contract is now explicit, and several flags change:

```
demonolith refactor            # map → run → validate → diff   (the code split)
  refactor validate            #   NEW: ask the engine whether it accepts what was written
  refactor diff                #   RENAMED from `refactor verify`
```

- **`refactor validate`** (new): the engine's own check on every written
module directory — needs `--engine`, no credentials. `refactor verify
--validate` is gone.
- **`refactor verify` is now `refactor diff`** — the same gate, with
`diff` exit semantics. Update CI invocations.
- **`refactor run` owns its target directories**: they must not exist,
or `--overwrite` deletes and rewrites them. For path-relative file
reads, pass content through a variable (see LIMITATIONS.md).
- **`migrate map` always pulls and re-splits** — leftovers are compared,
never trusted; safe to re-run after a crash.
- **No step refreshes**: `--refresh` is removed; drift is out of scope —
rule it out with a clean monolith plan first. Prove and verify list each
module's live data-source reads.
- **`migrate run --overwrite` is renamed `--force`**.
- **`--output` is removed**: machines read exit codes and receipts.
<!-- /release-notes -->