test: restructure the local suite into unit/cli/contract layers

[scarmuega]

Why

The e2e suite required a real tx3c (and for one test, dolos + cshell) on the runner, so CI could never run half of it — see the failures on #127. Beyond the missing binaries it had three structural problems:

• Vacuous passes: trix_toml_rejects_alias_only_ref / trix_toml_rejects_latest_ref only asserted a non-zero exit — on a runner with no tx3c, every command fails, so they were green for the wrong reason.
• A shared-state flake: parallel tests raced on the real ~/.tx3/trix/config.toml (check-then-write in global::ensure_global_config), producing the TOML parse error at line 1 failure on ci: make CI green #127 — and the suite wrote into the developer's real ~/.tx3.
• Environment-dependent results: locally the suite picked up whatever toolchain was installed, so a dev run and a CI run tested different things.

What

Restructure around the process boundary: each assertion moves to the innermost layer that can make it, and no test in this repo requires a real helper binary. Real cross-binary interop is the umbrella's DX e2e journeys' job (solution/e2e/), which gate toolchain releases with real released binaries.

Layer	Where	Spawns	Asks
Unit	src/** #[cfg(test)]	nothing	are the rules right?
CLI	tests/cli/	trix only	is the binary wired to the rules?
Contract	tests/contract/	trix + a fake tx3c	is trix's side of the tx3c contract right?

• Unit: extracted interfaces::verify_cache_at (cache integrity rules, now testable against any directory) and added unit tests for it, interfaces::validate, and the resolver. The formerly vacuous lockfile tests are real assertions here now.
• CLI: init scaffolding/preservation plus one wiring probe per fail-before-spawn error path (clap ref rejection, unknown alias, [interfaces] validation, digest tamper — which provably fires before tool resolution).
• Contract: a std-only fake tx3c compiled at test time with plain rustc (deliberately not a cargo target — it cannot leak into dist artifacts). Tests assert what trix sends (argv, project-source-lowered vs cached-TII-decoded routing, per-protocol codegen layout) and how it interprets results (diagnostics envelope, garbage stdout, tool death, and the version gate against arbitrary reported versions — coverage real binaries can't provide).
• Hermeticity: new TX3_HOME override for the ~/.tx3 root (cross-platform, unlike faking $HOME). Every spawned trix gets a throwaway root, an empty PATH, and scrubbed TX3_* vars: no more global-config race, no writes to the real ~/.tx3, identical behavior on a loaded dev machine and a bare runner.
• Deleted: devnet_starts_and_cshell_connects (journey 04 covers the real round-trip better; its pkill -f dolos cleanup also killed unrelated processes) and the unused predicates/insta/libc dev-deps.

tests/README.md documents the methodology and where a new test belongs.

Verification

All of CI's gates pass locally with no toolchain reachable (TX3_HOME isolation + empty PATH reproduce a bare runner):

• cargo fmt --all -- --check ✓
• cargo clippy --all-targets --all-features -- -D warnings ✓
• cargo test --workspace --all-targets --all-features ✓ — 103 tests (78 unit / 10 cli / 15 contract), ~1.5s, zero ignored

Follow-ups (umbrella, not this repo)

Per the release-gate methodology, two journey gaps exist regardless of this PR: no journey exercises trix codegen or trix use/[interfaces] with real binaries. Those belong in solution/e2e/ as new journeys.

🤖 Generated with Claude Code