refactor(config): T-1281 — the check domain retires its five scripts

All five gates are ported, tested against their failure paths, and the
originals are gone. reach check is the only way to run them.

Parity first, then deletion. Every case in test_check.py began as a parity case
running the new implementation beside the script it replaced; that evidence is
in the ticket. With the scripts retired there is nothing left to compare
against, so the assertions become the spec and the file drops its "_parity"
name. A parity test is scaffolding with a defined lifetime — keeping one after
its subject is deleted would mean keeping the subject alive to be compared
with, which is the opposite of a migration.

Two gates could not be parity-tested in a fixture at all, and both reasons are
findings rather than obstacles. canvas-version: canvas_sources globs from a
__file__ root while the service resolves git through config.repo_root(), so a
fixture would diff one tree and glob another — real history is used instead,
including two genuine instances of the regression the gate exists to catch.
systems-db-stamp: generator_sources raises at IMPORT time when the economy-db
tree is absent, so the old script died before reaching any logic in every
fixture. The ported service imports it lazily and after the absent/unstamped
checks, which is exactly why those states are testable now and were not before.

Hooks rewired: pre-commit runs reach check fact-ids, pre-push runs the other
four. Both pass --no-input, because a hook has no TTY and a prompt there does
not wait, it crashes. Both guard on `command -v reach` and skip with a message
rather than blocking every commit on a missing tool.

Make targets are RETIRED, not wrapped, per the D-263 split — with the mapping
left as a comment where they used to be. Wrapping would leave two ways to
invoke each gate, and reach --help would stop being the answer to "what tooling
exists" while the Makefile remained a competing index. pre-pr-validate and
pre-pr-content keep their orchestration role and lose the individual target.

Sprint archives and workshop notes still name the old paths and are left alone:
they record what was true when written.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/DEVOPS.md

@@ -98,7 +98,7 @@ match and will prompt. That is accepted rather than worked around: an
 environment override is a genuine departure from the normal invocation, and the
 ordinary form is what needs to be frictionless. Tests that need overrides
 should pass them through the subprocess environment rather than the command
-string, as `tooling/test_check_parity.py` does.
+string, as `tooling/test_check.py` does.
 
 ### Build
 
@@ -285,7 +285,7 @@ make regen-db
 
 After every successful non-dry-run, the generator writes a row to the `meta` table in
 `systems.db` recording the SHA-1 of its source files and the schema file.  The source
-registry is the `GENERATOR_SOURCES` dict in `tooling/check-systems-db-stamp`.
+registry is the `GENERATOR_SOURCES` dict in `tooling/generator_sources.py`.
 
 ```bash
 make check-systems-db    # Verify the stamp is fresh (exit 1 = stale)
@@ -316,7 +316,7 @@ never be invalidated — see T-1241, and T-1239 for what a stale canvas cache ac
 costs.
 
 ```bash
-make check-client-version    # exit 1 = the two files disagree
+reach check client-version   # exit 1 = the two files disagree
 ```
 
 The pre-push hook runs this unconditionally (drift persists on `main` once
@@ -334,7 +334,7 @@ one took eight days to find (T-1239) because the failure is invisible to its aut
 reproduces only where a warm cache exists.
 
 ```bash
-make check-canvas-version    # exit 1 = generation changed, version didn't
+reach check canvas-version   # exit 1 = generation changed, version didn't
 ```
 
 The path registry is `tooling/canvas_sources.py` — globbed, not hand-listed, so a
@@ -372,7 +372,7 @@ git config core.hooksPath .config/hooks
 
 | Check | Script | Behavior |
 |-------|--------|----------|
-| fact_id validation | `tooling/check-fact-ids` | Warns if catalogs are stubs; fails on unknown fact_ids when populated |
+| fact_id validation | `reach check fact-ids` | Warns if catalogs are stubs; fails on unknown fact_ids when populated |
 | Decision records | `pql decisions validate` | Blocks on malformed decision records (warns if pql not on PATH) |
 | Planning changelog | `pql plan export --stage` | Flushes ticket mutations to `.pql/changelog/` and stages them into the commit (warn-only on failure) |
 | cargo audit | `cargo audit` | Only when `Cargo.toml`/`Cargo.lock` is staged; blocks on advisories (warns if cargo-audit not installed) |