Give the command-line host validate, render, transform and parse

[zoosky]

Step 5 of specs/features/cli-and-host-seams.md, and the step the host exists for: with validate a documentation repository is a CI gate, and with --partials {% partial %} works outside a bespoke Rust host for the first time. No library change; conformance holds at 95 green, 10 annotated, 0 failing (of 105).

Commands

Command	Does	Needs configuration
validate	path:line:column: level[id]: message per error, or --format json	for tags of your own
render	HTML, inputs concatenated	for tags of your own
transform	the renderable tree as JSON, one array per input per line	for tags of your own
parse	the syntax tree as JSON, one value per input per line	no

validate exits 1 only at level error or critical; a warning is printed and passes, because the library's error_level exists to ship a rule that is surfaced but not yet enforced. --file LABEL names stdin in diagnostics. A file that cannot be read is reported and the run goes on (exit 2).

Configuration

• --config PATH — YAML or JSON, in the shared vocabulary. Read with saphyr, the reader the conformance harness already uses (pure Rust, no serde); a YAML node implements Declaration, so keys are refused before values are read, and a hook is refused with its path and this host's reason ("a configuration file cannot hold code; keep the hook in a Rust host").
• --partials DIR — every file under the directory, at any depth, keyed by relative path with /. Read into a Sources arena before the config is built, because a Config borrows its partials' sources — the lifetime shape the spec warned would otherwise cost a rewrite.
• --var NAME=VALUE — VALUE read as YAML by the same reader as the file, so count=3 is the number, name=x the string, 'v="3"' the string 3, and --var and --config can never disagree. Overrides the file's. Errors report at config.variables.NAME.

JSON

Hand-written, iterative encoders in json.rs — the library carries no serde, and the shapes are upstream's: a tag is {"$$mdtype":"Tag","name","attributes","children"} in tag.ts order, so this and JSON.stringify over upstream's object produce the same bytes; a syntax-tree node carries every field including annotations ({type, name, value}) and parser errors; a validate error is the bindings' {type, lines, location?, error} with byte columns. Non-finite numbers are null, as JSON.stringify has them. Decision 11 in the spec records the output-shape choices.

Tests

18 in tests/commands.rs over the built binary: tag-undefined (level critical, as upstream has it) without a config; a correct document passing with the YAML and with the JSON config; a missing required attribute by line and column; --format json as one object per input in the bindings' shape; --file labelling stdin; an unreadable input reported and skipped; a hook refused with its path and reason; a missing config; a malformed --var; the configured element rendered; partials inlined from a nested directory; typed vars (n=3 satisfies equals($n, 3); n="3" does not) overriding the file; inputs concatenated in order; transform and parse shapes; JSON escaping. Nothing unwraps.

Gates

CLI clippy and 15 + 18 tests, library clippy over both lanes and tests, vocabulary crate, wasm clippy, docs, standalone — all pass locally.

Review fixes

Eight findings from /code-review, all reproduced against the binary, plus three the review cut for room — all taken, nine tests added (27 total; one Unix-only for the symlink):

• validate --format json writes the bindings' positions exactly — line, character and offset in UTF-16 code units, byteOffset in bytes — from a per-document Utf16Index, instead of column in bytes under a parity claim. The human column counts characters.
• parse matches JSON.stringify(Markdoc.parse(src)) — upstream's field order (attributes first after the marker), tag/location omitted rather than null, numbers in ECMAScript's spelling via the library's own attribute_value, and \\b/\\f escapes.
• Partials: a non-UTF-8 file is passed over rather than aborting the run; a directory symlink is not followed (a file symlink is read); the README says both.
• YAML keys: a scalar key is its text and is found by text (2024:, true:); a list or mapping key is refused by name. Tagged keys are found under their plain spelling.
• One YAML document: a second after --- is refused rather than dropped.
• --var =3 is refused with the existing NAME=VALUE message.
• Cleanups: the three commands share host::load/host::configured; Yaml<'a>(&'a YamlOwned) borrows instead of cloning subtrees on every get/items; the manifest description no longer says the commands are "to follow"; the README no longer claims fmt takes --file.