feat: make the code-intel engine swappable behind the tldr contract

[arzafran]

What this does

cc-settings gets all its code intelligence (the mcp__tldr__* tools — call graphs, semantic search, impact) from llm-tldr, a pipx tool whose last commit was January 2026 — effectively abandoned, and wired into ~6 places. This makes the engine behind the tldr MCP server a single swappable choice instead of a hardcoded dependency, and ships a native, zero-dependency TypeScript engine as an opt-in alternative built on the TypeScript compiler.

Nothing changes unless you opt in: the default stays llm-tldr, and the tldr server key, the 18 mcp__tldr__* tool names, and the serverInstructions are byte-for-byte identical. Set CC_CODE_INTEL_ENGINE=native-ts to switch the engine behind the same contract.

The point is resilience: own the interface, rent the engine defensively. A future external engine ships as a checksum-pinned binary that's verified before it ever runs, so an upstream going dark can't strand us.

Summary

Part B — engine indirection + pin/verify

• src/lib/code-intel-engine.ts — zod EngineDescriptor + a 3-engine registry (llm-tldr default, native-ts, codebase-memory placeholder). resolveEngine resolves env CC_CODE_INTEL_ENGINE > install sentinel > default; finalize fills install-location paths; ensureEngineInstalled provisions per install method.
• src/lib/engine-pin.ts — checksum-pinned download/verify for binary engines. Mismatch deletes the download and throws (security boundary); missing checksum or network error fails soft. SLSA/sigstore provenance is a designed stub. Mirrors hooks-fingerprint.ts.
• Wiring threads the resolved engine through setup.ts (deps, MCP-block rewrite, sentinel engine field), session-start.ts (engine-aware daemon/warm + status line), post-edit.ts (gated daemon notify), and verify-hooks.ts (third fail-open pin-integrity check).
• The MCP server key, tool names, and serverInstructions semantics are unchanged — only the engine behind them swaps. Per-project routing behind the same name is deferred to a future MCP proxy (not built here).

Part A — native TS codemap engine (src/codemap/)

• TypeScript-compiler-based, zero runtime deps, TS/JS only. Covers the daily-80%: structure, tree, arch, imports/importers, calls, context, impact, change-impact (no semantic/dataflow/slice/dead — those return a structured unsupported-by-native-engine).
• A newline-delimited JSON-RPC 2.0 stdio MCP server exposes all 18 contract tool names so the skill's allowed-tools stays valid regardless of engine.

Docs: mcp-configs/recommended.json + skills/tldr/SKILL.md describe the pluggable engine (allowed-tools untouched).

A separate chore: commit carries an unrelated biome line-reflow in settings.ts (kept because reverting fails bun run lint), isolated from the feature diff.

Test Plan

• bun run typecheck
• bun run lint (exit 0)
• bun run lint:skills (0 errors)
• bun run schemas:check (no schema drift)
• bun test — 655 pass / 0 fail (engine resolver/descriptor/regression, pin install/mismatch/fail-soft, codemap fixture suite)
• Install smoke (throwaway HOME): default → tldr=tldr-mcp, sentinel engine: "llm-tldr"; CC_CODE_INTEL_ENGINE=native-ts → tldr=bun …/codemap/mcp-server.ts, sentinel engine: "native-ts"
• MCP smoke: tools/list returns 18 tools; impact resolves a symbol cross-file; unsupported tool returns the structured error