feat(config): T-1283 — the godot and visual domains

reach godot parse-sweep / cold-parse, reach visual diff / blank-check /
thumbnail. Five scripts retired, and the callers rewired — tests/run-visual
invoked three of them by path at four sites, which is a wider blast radius than
the make targets were.

The godot pair were grep pipelines encoding five hard-won lessons as comments
nobody could test. They are Python filters now, with the reasons attached, and
the engine invocation is a guarded exec. Verified on the real client: 229
scripts, clean.

Their three not-ok states stay distinct, because only one is a verdict about
the code. An engine that crashed or is missing is not a parse failure —
reporting it as one blames the tree for a broken toolchain. A sweep that
emitted no completion marker checked nothing, and zero errors from a check that
never ran reads as clean, which is the false-green the sweep exists to close.
The deliberate asymmetry between the two checks is preserved and documented:
cold-parse filters "Cannot infer the type", the sweep does not, because that
suppression is why cold-parse stayed silent about a helper that genuinely does
not parse.

All three visual scripts carried the same root bug as validate-checklist:
Path(__file__).parent.parent, correct at tooling/ and two levels too deep at
tooling/domains/visual. Fixed during the move rather than after, having learned
that it fails silently — paths resolve to nothing, the work appears to have
nothing to do, and the tool reports success. Three domains now where that would
have shipped a false pass.

Two bugs my own transformation introduced, both found by running rather than
reading. Multi-line print(..., file=sys.stderr) became console.event(...,
file=sys.stderr), and console puts unknown kwargs into the payload — a file
object would have reached json.dumps at the exact moment something was already
being reported as an error. And the replacement script wrote escaped quotes
into three files. Mechanical transformations need mechanical verification.

sys.exit removed from four sites: a service must not end the process.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/run-visual

@@ -244,7 +244,7 @@ if [[ "$MODE" == "screenshot" ]]; then
         # genuinely renders nothing is a legitimate thing to want to look at
         # (that is how the empty deep rungs were found). But say so out loud,
         # because file size alone reads as success.
-        "$ROOT/tooling/visual-blank-check" "$PNG" --quiet || true
+        reach --no-input visual blank-check "$PNG" --quiet || true
     else
         echo "Error: capture failed — $PNG not found" >&2
         exit 1
@@ -267,8 +267,8 @@ if [[ "$MODE" == "movie" ]]; then
         echo "Flow: $FRAME_COUNT frames in $FLOW_DIR"
 
         # Generate contact sheet if visual-thumbnail is available
-        if [[ -x "$ROOT/tooling/visual-thumbnail" ]]; then
-            "$ROOT/tooling/visual-thumbnail" "$FLOW_DIR" --config "$CONFIG"
+        if command -v reach >/dev/null 2>&1; then
+            reach --no-input visual thumbnail "$FLOW_DIR" --config "$CONFIG"
             SHEET="$FLOW_DIR/${TARGET}_sheet.png"
             [[ -f "$SHEET" ]] && echo "Contact sheet: $SHEET"
         fi
@@ -345,7 +345,7 @@ for scenario in "${SCENARIOS[@]}"; do
     # Checked in BOTH modes, and the update mode matters most: refusing to
     # RECORD a blank golden is what stops the trap being re-armed.
     set +e
-    BLANK_OUT=$("$ROOT/tooling/visual-blank-check" "$CAPTURED" 2>&1)
+    BLANK_OUT=$(reach --no-input visual blank-check "$CAPTURED" 2>&1)
     BLANK_RC=$?
     set -e
     if [[ $BLANK_RC -ne 0 ]]; then
@@ -368,7 +368,7 @@ for scenario in "${SCENARIOS[@]}"; do
 
         # Compare
         set +e
-        DIFF_OUT=$("$ROOT/tooling/visual-diff" "$GOLDEN" "$CAPTURED" \
+        DIFF_OUT=$(reach --no-input visual diff "$GOLDEN" "$CAPTURED" \
             --tolerance "$TOLERANCE" \
             --diff-output "$DIFF_DIR/$scenario-diff.png" \
             --config "$CONFIG" 2>&1)