feat(config): per-check thresholds in .checkup.yml (complexity CCN, duplication %)

[maudlin]

What

The .checkup.yml override layer shipped stack / checks / commands but deferred per-check thresholds — so the complexity and duplication banding were hardcoded literals an owner couldn't tune without editing the orchestrator.

Adds a thresholds: block:

thresholds:
  complexity_ccn_warn: 10   # report functions at/above this CCN (ESLint + lizard engines)
  complexity_ccn_fail: 30   # any function at/above this → the complexity record fails
  duplication_warn_pct: 3   # duplication % at/above this → warn
  duplication_fail_pct: 5   # …→ fail

• Parsed by lib/config.sh into CHECKUP_CPLX_CCN_WARN/_FAIL + CHECKUP_DUP_WARN_PCT/_FAIL_PCT — integers, validated (garbage warns and is ignored, keeping the default; parser ethos: never abort, never a false pass).
• bin/checkup.sh resolves each with the historical literal as default (_cfg_int guards a hand-set non-integer from reaching jq / [ -lt ]), then threads them through the complexity CCN arms (ESLint --rule level — built so the default renders the exact historical JSON; lizard/eslint select + severity bands; the merged-record fail cutoff via complexity-merge.jq's $ARGS.named.fail // 30) and the duplication jscpd/lizard percentage bands.

Tunes a check's status only — never the health score (ADR-0009). scc's heuristic complexity band is a different scale and keeps its own cutoffs.

Why this is safe

An absent thresholds: block defaults every knob to today's literal → byte-identical to before.

Verification

• Full CI suite green (12 suites); config.test.sh +13 cases → 33 passing (parse, integer validation, unknown-key warn, _cfg_int, and the existing example-sync test now exercises the live block).
• End-to-end: complexity + duplication records byte-identical on no-config runs; knobs move the band as configured — complexity fail: 11 flips a CCN-13 repo warn → fail; duplication on a 75%-clone repo is fail by default and pass with warn: 95.

Documented in .checkup.yml.example (live block) and the README overrides section.

Closes #72

🤖 Generated with Claude Code