[codex] seed rust migration foundation

[JeremyDev87]

Summary

• add Phase 1 Rust migration foundation assets, including Cargo workspace scaffolding for legolas-core and legolas-cli
• add stable JS parity fixtures and checked-in oracle outputs for scan/help/version/error contracts
• add Node contract tests plus shared oracle normalization helpers so the checked-in oracles are actually enforced and remain cross-platform deterministic

Why

This seeds the Rust migration with a fixed parity baseline before any runtime cutover. It gives later Rust port phases a concrete JSON/text/error contract to match while keeping the shipped Node CLI as the source of truth.

Impact

• no change to the shipped npm/bin runtime path yet
• future Rust phases can build against committed fixture/oracle data instead of reconstructing expected output ad hoc
• JS tests now fail if help text, report output, JSON shape, or validation-error contracts drift from the committed oracle set

Notes

• Rust modules are scaffold-only in this PR; cargo/rustc were not available in this environment, so Rust compile validation could not be run here
• independent devil's-advocate review findings about oracle enforcement and cross-platform determinism were addressed before publishing

Validation

• node ./scripts/generate-rust-parity-fixtures.mjs
• node --test

[JeremyDev87]

Independent fresh-session review result

• Verdict: CHANGE_REQUEST
• Findings:
  • High: The new Rust workspace is not shown to be buildable with the declared toolchain. Fresh-session review flagged that the pinned toolchain/dependency combination may fail during cargo test --workspace, and there is no committed Cargo.lock, so the new workspace is not reproducibly testable yet. Files: Cargo.toml, rust-toolchain.toml.
  • High: The added parity/oracle validation still only exercises the existing JavaScript implementation, while the new Rust entry points remain stubbed as NotImplemented. That means the new tests can stay green while the Rust CLI/core are still unusable. Files: scripts/generate-rust-parity-fixtures.mjs, test/cli.test.js, test/analyze-project.test.js, crates/legolas-cli/src/main.rs, crates/legolas-cli/src/argv.rs, crates/legolas-core/src/analyze.rs, crates/legolas-core/src/workspace.rs.
  • Medium: CI does not validate the new Rust workspace, so Cargo/crate regressions would not be caught on PRs yet. File: .github/workflows/ci.yml.
• Rationale: Two independent fresh-session reviewers both landed on CHANGE_REQUEST because this PR introduces a Rust implementation surface without proving that the Rust foundation is currently buildable and meaningfully validated.

Note: This was posted as a PR comment instead of an official GitHub review because the PR is self-authored under the same GitHub account, so GitHub policy prevents submitting an official approve/request-changes review.

[JeremyDev87]

Independent fresh-session review result

• Verdict: CHANGE_REQUEST
• Findings:
  • High: The new Rust path is still nonfunctional. A normal cargo run -p legolas-cli -- --version exits through NotImplemented, so the added CLI/core crates cannot handle real invocations yet. Files: crates/legolas-cli/src/main.rs, crates/legolas-cli/src/argv.rs, crates/legolas-core/src/analyze.rs.
  • Medium: The new parity/oracle coverage still validates only the existing JS implementation; the Rust workspace has no behavioral coverage yet, so the stubbed Rust path can land without tests catching it. Files: test/analyze-project.test.js, scripts/generate-rust-parity-fixtures.mjs.
• Rationale: The fresh-session reviewer still considered this a CHANGE_REQUEST because the branch adds a Rust workspace and binary entry point, but the runtime Rust path remains intentionally stubbed and unexercised.

Note: This was posted as a PR comment instead of an official GitHub review because the PR is self-authored under the same GitHub account, so GitHub policy prevents submitting an official approve/request-changes review.

[JeremyDev87]

Independent fresh-session review result

• Verdict: CHANGE_REQUEST
• Findings:
  • High: The Rust foundation entrypoints are still placeholders, so the new Rust CLI cannot yet parse arguments, analyze a project, or emit reports. Files: crates/legolas-cli/src/main.rs, crates/legolas-cli/src/argv.rs, crates/legolas-core/src/analyze.rs, crates/legolas-cli/src/reporters/text.rs.
  • Medium: CI still validates only the Node path, so the added Rust workspace and toolchain are not checked on PRs yet. File: .github/workflows/ci.yml.
• Rationale: The fresh-session reviewer still considered this a CHANGE_REQUEST because the PR adds a Rust foundation, but the core Rust path remains nonfunctional and lacks CI validation.

Note: This was posted as a PR comment instead of an official GitHub review because the PR is self-authored under the same GitHub account, so GitHub policy prevents submitting an official approve/request-changes review.

[JeremyDev87]

Independent fresh-session review result

• Verdict: APPROVE
• Findings: none
• Rationale: I didn’t find a merge-blocking correctness, workflow, or validation issue. The new Rust workspace and CI wiring are coherent, and both cargo test --workspace and npm test pass locally.

Note: This was posted as a PR comment instead of an official GitHub review because the PR is self-authored under the same GitHub account, so GitHub policy prevents submitting an official approve review.