refactor(config): T-1281 — the check domain retires its five scripts

All five gates are ported, tested against their failure paths, and the
originals are gone. reach check is the only way to run them.

Parity first, then deletion. Every case in test_check.py began as a parity case
running the new implementation beside the script it replaced; that evidence is
in the ticket. With the scripts retired there is nothing left to compare
against, so the assertions become the spec and the file drops its "_parity"
name. A parity test is scaffolding with a defined lifetime — keeping one after
its subject is deleted would mean keeping the subject alive to be compared
with, which is the opposite of a migration.

Two gates could not be parity-tested in a fixture at all, and both reasons are
findings rather than obstacles. canvas-version: canvas_sources globs from a
__file__ root while the service resolves git through config.repo_root(), so a
fixture would diff one tree and glob another — real history is used instead,
including two genuine instances of the regression the gate exists to catch.
systems-db-stamp: generator_sources raises at IMPORT time when the economy-db
tree is absent, so the old script died before reaching any logic in every
fixture. The ported service imports it lazily and after the absent/unstamped
checks, which is exactly why those states are testable now and were not before.

Hooks rewired: pre-commit runs reach check fact-ids, pre-push runs the other
four. Both pass --no-input, because a hook has no TTY and a prompt there does
not wait, it crashes. Both guard on `command -v reach` and skip with a message
rather than blocking every commit on a missing tool.

Make targets are RETIRED, not wrapped, per the D-263 split — with the mapping
left as a comment where they used to be. Wrapping would leave two ways to
invoke each gate, and reach --help would stop being the answer to "what tooling
exists" while the Makefile remained a competing index. pre-pr-validate and
pre-pr-content keep their orchestration role and lose the individual target.

Sprint archives and workshop notes still name the old paths and are left alone:
they record what was true when written.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.config/hooks/pre-commit

@@ -22,7 +22,17 @@ run_check() {
 }
 
 # --- Checks ---
-run_check "tooling/check-fact-ids" "fact_id validation"
+# Ported to the reach CLI (T-1281). --no-input because a hook has no TTY and a
+# prompt there does not wait, it crashes. If reach is missing the check is
+# skipped with a message rather than blocking every commit on a tooling install.
+if command -v reach >/dev/null 2>&1; then
+    if ! reach --no-input check fact-ids; then
+        ERRORS=$((ERRORS + 1))
+    fi
+else
+    echo "pre-commit: WARNING — fact_id validation skipped (reach not on PATH)"
+    echo "  Run 'make install-reach'."
+fi
 
 # --- pql: decision integrity + durable planning changelog ---
 # Replaces the old SQLite decisions-sync hook. Decisions are markdown-sourced (D-8):

.config/hooks/pre-push

@@ -257,10 +257,10 @@ fi
 # first push).  We compare against origin/main — which always exists — so the
 # check covers the first-push case.
 DB_IN_PUSH=$(git diff --name-only origin/main...HEAD -- server/data/systems.db 2>/dev/null | wc -l)
-if [ "$DB_IN_PUSH" -gt 0 ] && [ -f "$REPO_ROOT/tooling/check-systems-db-stamp" ]; then
+if [ "$DB_IN_PUSH" -gt 0 ] && command -v reach >/dev/null 2>&1; then
     echo "pre-push: checking systems.db stamp..."
     rc=0
-    python3 "$REPO_ROOT/tooling/check-systems-db-stamp" || rc=$?
+    reach --no-input check systems-db-stamp || rc=$?
     if [ "$rc" -eq 1 ]; then
         # rc=1 means stale / unknown generator / missing source; message on stderr
         echo "  Fix: run 'make regen-db' then stage server/data/systems.db"
@@ -289,9 +289,9 @@ fi
 # introduced by touching one file without the other, but it PERSISTS on main
 # until someone notices, so gating on "was either file in this push" would let
 # an existing drift ride along indefinitely. The check is two file reads.
-if [ -f "$REPO_ROOT/tooling/check-client-version" ]; then
+if command -v reach >/dev/null 2>&1; then
     echo "pre-push: checking client version mirror..."
-    if python3 "$REPO_ROOT/tooling/check-client-version"; then
+    if reach --no-input check client-version; then
         :
     else
         fail_check "client version mirror (drifted from project.yaml)"
@@ -307,9 +307,9 @@ fi
 #
 # Self-check first: the registry fails closed on an empty glob, and a registry
 # that cannot load must not be read as "nothing to enforce".
-if [ -f "$REPO_ROOT/tooling/check-canvas-version" ]; then
+if command -v reach >/dev/null 2>&1; then
     echo "pre-push: checking canvas-generation version pairing..."
-    if python3 "$REPO_ROOT/tooling/check-canvas-version"; then
+    if reach --no-input check canvas-version; then
         :
     else
         fail_check "canvas generation changed without a project.yaml version bump"
@@ -321,9 +321,9 @@ fi
 # moves, so the map keeps asserting a layout that is no longer true. This checks
 # only that the paths still resolve; whether an EDGE still means what it says is
 # a human check against the tool's source. Cheap (no subprocess beyond python).
-if [ -f "$REPO_ROOT/tooling/check-dataflow-graph.py" ]; then
+if command -v reach >/dev/null 2>&1; then
     echo "pre-push: checking data-flow diagram paths..."
-    if python3 "$REPO_ROOT/tooling/check-dataflow-graph.py"; then
+    if reach --no-input check dataflow-graph; then
         :
     else
         fail_check "a path named in a data-flow diagram no longer resolves"