feat(config): T-1285 — the atlas authoring verbs, and a verify nobody checked

reach atlas db / names / systems-done / check / verify / commit-and-sync /
update-field / flatness. Eight scripts retired, five of them bash. verify
reproduces the original exactly: 2 errors across 301 proposals, exit 1.

The binary has more verbs than its wrapper documented. The bash usage text
listed four; atlas-commit-and-sync calls four more it never mentioned. All
eight are declared so reach atlas --help is a complete index, and unknown verbs
are still forwarded — a hand-maintained list falls behind the binary it
describes, so rejecting on it would break the day someone adds a subcommand.

commit-and-sync now stages by default and commits only with --commit. Nothing
else in reach writes to git history, and committing as a side effect of "sync"
is a different risk class from writing a file; the default prints the message
it would use, leaving the decision where it was.

Two real bugs found in that script while porting it. It ran atlas-verify and
never checked the exit code, so a proposal that FAILED verification was still
wiped, committed and synced — bad data in systems.db is far harder to undo than
a failed command, and it now refuses. And it hardcoded a pinned
"Co-Authored-By: Claude Opus 4.6" into every atlas commit, which the git-commit
skill names as the root cause of attribution drift.

update-field gains two guards the original lacked. Its field→table map lived
inside a bash heredoc string where nothing could check it, and an unknown field
produced an UPDATE against a table of None; it now names the nine accepted
fields. And it checks rowcount, so a system_id that does not exist is a failure
rather than a silent no-op reported as success.

The three Python scripts moved with the usual treatment — prints to console
events, argparse replaced by typed functions, __file__ roots to
config.repo_root(). No root bug this time: checked before moving rather than
after, three domains running.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Makefile

@@ -4,7 +4,7 @@ GODOT := $(shell command -v godot4 2>/dev/null || command -v godot 2>/dev/null)
        install-reach reach-repoint \
        decisions-sync decisions-active decisions-validate \
        setup-hooks install-hooks \
-       audit deny atlas-verify economy-db regen-db \
+       audit deny economy-db regen-db \
        pre-pr pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures \
        pre-pr-server pre-pr-client pre-pr-content \
        fixtures-client fixtures-gauntlet golden-diff golden-update \
@@ -55,7 +55,6 @@ help:
 	@echo "  make decisions-validate Validate decision records — malformed-record gate (pql)"
 	@echo "  make audit              Run cargo audit (security advisory check)"
 	@echo "  make deny               Run cargo deny check (license/ban policy)"
-	@echo "  make atlas-verify      Verify atlas proposal JSONs (all in docs/atlas/proposals/)"
 	@echo "  make star-map-data     Regenerate client/data/star_map_data.json from systems.db + wiki"
 	@echo "  make check-star-map    Assert star_map_data.json is up to date (part of pre-pr-client)"
 	@echo "  make economy-db        Import economics data into systems.db (TOML/JSON → SQLite)"
@@ -424,7 +423,7 @@ pre-pr-server: lint-server build-server test-server pre-pr-fixtures audit deny
 pre-pr-client: lint-client build-client test-client check-star-map
 	@echo "=== Client pre-PR: PASSED ==="
 
-pre-pr-content: atlas-verify
+pre-pr-content:
 	@echo "=== Content pre-PR: PASSED ==="
 
 # --- CI (run locally) ---
@@ -472,6 +471,7 @@ regen-db:  ## Regenerate systems.db from all sources and stamp meta table (#855,
 #   make validate-content      -> reach validate content
 #   make checklist-validate    -> reach validate checklist --check
 #   make checklist-generate    -> reach validate checklist
+#   make atlas-verify          -> reach atlas verify
 #
 # Wrapping them would leave two ways to invoke each, and `reach --help` would
 # stop being the answer to "what tooling exists" because the Makefile would
@@ -505,9 +505,6 @@ decisions-validate:
 
 # --- Content Validation ---
 
-atlas-verify:
-	@tooling/atlas-verify docs/atlas/proposals/*.json
-
 audit:
 	cd server && cargo audit