feat(config): T-1285 — the atlas authoring verbs, and a verify nobody checked

reach atlas db / names / systems-done / check / verify / commit-and-sync /
update-field / flatness. Eight scripts retired, five of them bash. verify
reproduces the original exactly: 2 errors across 301 proposals, exit 1.

The binary has more verbs than its wrapper documented. The bash usage text
listed four; atlas-commit-and-sync calls four more it never mentioned. All
eight are declared so reach atlas --help is a complete index, and unknown verbs
are still forwarded — a hand-maintained list falls behind the binary it
describes, so rejecting on it would break the day someone adds a subcommand.

commit-and-sync now stages by default and commits only with --commit. Nothing
else in reach writes to git history, and committing as a side effect of "sync"
is a different risk class from writing a file; the default prints the message
it would use, leaving the decision where it was.

Two real bugs found in that script while porting it. It ran atlas-verify and
never checked the exit code, so a proposal that FAILED verification was still
wiped, committed and synced — bad data in systems.db is far harder to undo than
a failed command, and it now refuses. And it hardcoded a pinned
"Co-Authored-By: Claude Opus 4.6" into every atlas commit, which the git-commit
skill names as the root cause of attribution drift.

update-field gains two guards the original lacked. Its field→table map lived
inside a bash heredoc string where nothing could check it, and an unknown field
produced an UPDATE against a table of None; it now names the nine accepted
fields. And it checks rowcount, so a system_id that does not exist is a failure
rather than a silent no-op reported as success.

The three Python scripts moved with the usual treatment — prints to console
events, argparse replaced by typed functions, __file__ roots to
config.repo_root(). No root bug this time: checked before moving rather than
after, three domains running.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tooling/domains/atlas/binary.py

@@ -0,0 +1,66 @@
+"""The Rust `atlas` binary, fronted (D-263).
+
+`tooling/atlas` was 24 lines of bash that built `server/target/debug/atlas` if
+missing and `exec`'d it with every argument. So its verbs never existed in the
+shell at all — they live in Rust, which is why this is a passthrough rather than
+a port.
+
+**The verbs are declared here even though the binary owns them.** That
+duplication is deliberate: `reach atlas --help` has to be a complete index of
+what exists, and an index that says "ask the binary" is not one. The cost is
+that a subcommand added on the Rust side is invisible here until someone adds a
+line — so `run()` also accepts anything, and an unknown verb reaches the binary
+rather than being rejected by a list that has fallen behind.
+"""
+
+from __future__ import annotations
+
+from tooling.core import config, console, process
+from tooling.core.errors import ReachError
+
+# What the binary offers today. Discovered from the wrapper's own usage text and
+# from atlas-commit-and-sync, which calls three verbs the wrapper never
+# documented — list-stations, wipe-system, commit-system, sync-wiki.
+KNOWN_VERBS = (
+    "stats",
+    "show-system",
+    "list-bodies",
+    "list-stations",
+    "populate",
+    "commit-system",
+    "wipe-system",
+    "sync-wiki",
+)
+
+
+def binary_path():
+    return config.path("server", "target", "debug", "atlas")
+
+
+def run(*args: str, capture: bool = True) -> str:
+    """Invoke the Rust atlas binary, building it first if it is absent."""
+    binary = binary_path()
+    if not binary.is_file():
+        console.event("building the atlas binary (first run)", level="warn")
+        build = process.run(
+            ["cargo", "build", "--bin", "atlas"],
+            cwd=config.path("server"),
+            check=False,
+            missing_fix="install Rust — make setup-rust",
+        )
+        if build.returncode != 0:
+            raise ReachError(
+                f"could not build the atlas binary\n{(build.stderr or '').strip()}",
+                fix="cd server && cargo build --bin atlas — to see the full error",
+                exit_code=build.returncode,
+            )
+
+    result = process.run([str(binary), *args], check=False, capture=capture)
+    if result.returncode != 0:
+        raise ReachError(
+            f"atlas {' '.join(args)} exited {result.returncode}\n"
+            + (result.stderr or "").strip(),
+            fix=f"run `{binary} {' '.join(args)}` directly for the full output",
+            exit_code=result.returncode,
+        )
+    return result.stdout or ""