feat(config): T-1281 — canvas-version, and typer's other rich path

All five gates now live in the check domain. canvas-version produces
byte-identical output to the original on the live tree.

It is the first real consumer of core/process.run. The git calls pass
check=False deliberately: a git failure here is not an error to report but a
signal that there is nothing to compare, since a fresh clone with no remote is
a legitimate state rather than a broken one. The argv-list and missing-binary
guards still apply.

Its two skips are kept distinct from its pass. NO_BASE and DIFF_FAILED exit 0,
as does CLEAN — but only CLEAN means the gate actually looked at something.
Collapsing them would hide a gate that had silently stopped running, which for
this check in particular is the exact failure it exists to prevent.

Found a second rich path while a NameError was rendering as a full-width
box-drawn traceback: typer's pretty-exception handler is a different mechanism
from rich_markup_mode, and setting one does nothing about the other. Same log
pollution T-1259 thought it had closed, arriving through another door and
landing in the worst place — a hook log at the moment something has already
gone wrong. pretty_exceptions_enable=False now on the root and on every domain
built by cli.domain().

test_canvas_version_check.py moves with the code it guards. It had been loading
the extensionless script through a SourceFileLoader and reaching canvas_sources
by sys.path insert, both only because tooling/ was not importable. Second
instance of that debt evaporating on contact. What it asserts is unchanged,
which is the point: diff_has_version_bump was kept pure in the port so its six
properties still hold without constructing git history.

Also restores an import the check router dropped in T-1267 when it moved to
cli.domain() — caught by running the command rather than by reading it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tooling/test_canvas_version_check.py

@@ -16,30 +16,20 @@ stays quiet otherwise. Two properties carry that, and neither is observable from
 Run: python3 tooling/test_canvas_version_check.py
 """
 
-import importlib.util
 import sys
 from pathlib import Path
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
-TOOLING = REPO_ROOT / "tooling"
 
-sys.path.insert(0, str(TOOLING))
-from canvas_sources import relative_paths  # noqa: E402
+# Re-pointed at the ported service (T-1281). This test previously loaded the
+# extensionless tooling/check-canvas-version through a SourceFileLoader and
+# reached canvas_sources via a sys.path insert — both because tooling/ was not
+# an importable package. Neither is needed now, and the test moves with the code
+# it guards rather than being left aimed at a script due for retirement.
+sys.path.insert(0, str(REPO_ROOT))
 
-
-def _load_check_module():
-    """Import the extensionless check script as a module."""
-    path = TOOLING / "check-canvas-version"
-    spec = importlib.util.spec_from_loader(
-        "check_canvas_version",
-        importlib.machinery.SourceFileLoader("check_canvas_version", str(path)),
-    )
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-check = _load_check_module()
+from tooling.canvas_sources import relative_paths  # noqa: E402
+from tooling.domains.check import service as check  # noqa: E402
 
 FAILURES: list[str] = []