feat: gate the committed config reference against drift

[N4M3Z]

Add the committed config reference and its drift gate. Task 2.5 of herdr-setup-ux.

• docs/config-reference.json: the compiler-backed reference, generated by the binary.
• tests/config_reference.rs: compares the committed copy against rune config reference
  output, so a config-struct change without a regenerated reference fails the suite.
  No workflow edits: the gate rides the existing test job.
• rune config reference prints through the shared reference_document().
• Validation: fmt, clippy -D warnings, and the full suite (25 suites) pass.
• Stacked on feat: add the setup wizard #50 as a sibling of docs: propose the discovery, distribution, and plugin changes #51.

Release Notes

• feat: the committed config reference fails CI when it drifts from the binary

Note

Add committed docs/config-reference.json and drift guard test

• Adds a committed pretty-printed JSON reference for config keys and defaults in config-reference.json, with a test in config_reference.rs asserting rune config reference output matches the committed file exactly.
• Rewrites rune setup into a plan/apply/verify flow supporting --plan (print plan only), --yes (apply detected defaults), and interactive confirmation. Setup now installs shell completions and agent skills per detected providers and writes a versioned SetupRecord to user config on success.
• Adds rune update --check subcommand that queries the GitHub releases API and signals update availability via exit code.
• Reworks rune skill install to target all enabled providers' skill directories, preserving user-modified files by comparing against a version-stripped rune-owned shape.
• Behavioral Change: rune setup requires explicit --plan or --yes for non-interactive use; rune config get on unknown keys no longer lists alternatives; Config schema gains a setup section that denies unknown fields in ontology.rs.

^{Macroscope summarized ed51f9c.}

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• review:coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 899e27da-9ec5-4103-ba0c-f3ab86a88dae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[N4M3Z]

@cursor review

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR combines a substantial setup workflow with provider gating, multiple filesystem writes and removals, changed skill-install behavior, and a new network-backed update command. The committed config reference and tests are low-risk, but the overall runtime and side-effect surface is broad.

Notes:

• Macroscope's correctness review did not run, so approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[runeseer]

Runeseer review — clean

Looks good. The extracted reference_document preserves the old reference behavior exactly, and the drift test is hermetic and deterministic: both defaults sources are compile-time embedded, entries are sorted by key, and serde_json runs without preserve_order, so map ordering is stable across runs.

• The committed reference is generated under the default full feature set; --all-features adds no config fields, so the CI build and release jobs agree.
• No other reviewer reported a defect on this change.

---

No open findings · Reviewed 7ea988e8 · review run · $0.98 · 2m4s · 27 turns

[runeseer]

Earned approval: review/correctness returned a clean verdict for 7ea988e. Dismissed automatically on any new push.

[runewright]

Awaiting the owner's review: this pull request cleared every lane 34h ago. The merge waits only on @N4M3Z.

[runewright]

Awaiting the owner's review: this pull request cleared every lane 26h ago. The merge waits only on @N4M3Z.

[runewright]

Awaiting the owner's review: this pull request cleared every lane 22h ago. The merge waits only on @N4M3Z.

Dismissing prior approval to re-evaluate 584678d

The base branch was changed.