feat(pipeline): the pure pipeline, checked against its goldens

The modules that turn a frozen range into passes and passes into a
verdict: :Schema, :Tools (the DENY, git and base lists, a leaf, so the
config and the pool both read them), :Plan, :Artifact, :Inventory,
:Dispositions, :State, :Normalize, :Stream, :Prompt, :Config, and the URL
half of :PgWire. Units, jobs, results, the config and the claude stream
stay JSON from end to end, so every key keeps its place; :Text gives JSON
values truthiness, get, ==, membership and Str(), and throws Dyn::Error
under a name for each kind of unexpected data.

Exactness where the bytes are seen:
- the stream classifiers are hand-written scanners with case-insensitive
  folds (the Kelvin sign is a k), Unicode \b and \s, and `.` stopping at
  \n; the SQL call detection takes `<exe> sql` with any path before it;
- config problems carry the JSON scanner's and the UTF-8 decoder's own
  texts, positions included;
- a float total is Neumaier's compensated sum, and the build passes
  -ffp-contract=off: -march=native would fuse a*b+c;
- `crafter-review inventory` and `config` print what the goldens record,
  byte for byte (the fixture and 14 configs, broken ones included); a
  message names this binary as the command to run.

tests/Goldens: the recorded answers over the fixtures next to them (the
commits fixture, a rich versioned series with CRLF, a folded subject,
Markdown headings in and out of fences, the code-key rewrites); the suite
compares 2304 results as DumpFile writes them, so a key out of order fails
too. All agree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

interfaces/Crafter.Review-PgWire.cppm

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
+
+export module Crafter.Review:PgWire;
+import std;
+import :Json;
+
+// The database under test: the SQL a lens with the `supabase` environment
+// runs, and the driver's probe before that lens's gate. The lens runs
+// `crafter-review sql`, which hands the SQL to the driver's broker: the
+// database URL, its password included, stays in the driver, and the pass's
+// process knows the broker's address and its stack's token alone.
+//
+// Every call of the helper is ONE transaction that is rolled back at its end,
+// so the passes of a run share one local database without seeing each
+// other, and the database must be on this machine (127.0.0.1, localhost,
+// ::1): the helper never reaches a hosted project.
+export namespace Crafter::Review::PgWire {
+    // Printed once the database answered; the pool looks for it.
+    constexpr std::string_view Answered = "review-gates sql: connected";
+    // Printed when it did not (exit 2).
+    constexpr std::string_view NoDatabase = "review-gates sql: NO DATABASE";
+    // Retired 2026-10-22: the URL stays in the driver; dropped from every
+    // pass's environment.
+    constexpr std::string_view UrlEnv = "REVIEW_GATES_DB_URL";
+    // `<host>:<port>#<token>`: the driver's broker and the pass's database,
+    // never a URL.
+    constexpr std::string_view BrokerEnv = "REVIEW_GATES_DB";
+    // The broker's last line: the call's exit code. Its NUL is part of it.
+    constexpr std::string_view ExitMark("\x00review-gates-exit ", 19);
+    constexpr std::array<std::string_view, 3> Loopback = {"127.0.0.1", "localhost", "::1"};
+    constexpr std::int32_t StatementTimeoutS = 20;
+    constexpr std::int32_t LockTimeoutS = 3;
+    // Rows printed per statement (all are counted).
+    constexpr std::int32_t MaxRows = 100;
+    // Characters printed per value.
+    constexpr std::int32_t MaxCell = 300;
+    // Characters printed per call; past it, statements still run and print
+    // their tags only.
+    constexpr std::int32_t MaxOutput = 40000;
+    constexpr std::int32_t MaxSql = 200000;
+    constexpr std::int32_t MaxStatements = 200;
+    constexpr std::int32_t ExitOk = 0;
+    constexpr std::int32_t ExitSql = 1;
+    constexpr std::int32_t ExitNoDb = 2;
+    constexpr std::int32_t ExitUsage = 64;
+
+    struct Url {
+        std::string scheme;
+        std::string host;
+        std::int32_t port = 5432;
+        std::string user;
+        std::string password;
+        std::string database;
+    };
+    // The URL's parts with the defaults: port 5432, user postgres, database
+    // postgres. std::invalid_argument with a ValueError text for a URL
+    // Dyn::UrlSplit refuses.
+    Url ParseUrl(std::string_view url);
+    // nullopt when the URL names a Postgres database on this machine, else the
+    // problem. Any JSON value: a config may hold anything.
+    std::optional<std::string> CheckUrl(const Json& url);
+    // The URL with its password replaced, for a log line or a dump.
+    std::string Redact(std::string_view url);
+    // "<database> on <host>:<port> as <user>"
+    std::string Where(std::string_view url);
+}