feat(check): emit the check result as a machine-readable document

[jdh313]

Adds --json to check, emitting one JSON document on stdout instead of the human lines.

$ agentforge check MARKETPLACE.yaml --out marketplaces --json
{
  "schemaVersion": 1,
  "marketplaceId": "jdh-agents",
  "status": "ok",
  "publications": [
    { "id": "claude", "status": "ok", "filesChecked": 213 },
    { "id": "codex",  "status": "ok", "filesChecked": 207 }
  ],
  "issues": [],
  "diagnostics": [ … ]
}

Why

compile already had --report with a JSON format; check had nothing. A consuming repository parses the diagnostic stream back apart — a regex over merged stdout and stderr, then re-deriving paths by string-matching the literal <root> token the formatter emits for root-anchored manifests.

That makes the consumer one formatting change away from silently finding zero issues. A gate that fails open is the wrong direction for a gate to fail, and this removes the parsing layer rather than asking every consumer to maintain one.

Design calls, each against a standing decision

• schemaVersion: 1 — ndr:r51yhr binds "the JSON compilation report, and any later machine-targeted format." This is one.
• No disposition grouping, though ndr:71jgk2 binds "every report format." Check codes are already dispositional — missing-output, changed-output, unsafe-output-content each name what became of the thing — and check issues carry no severity, so there is no axis to reorganise. Imposing the grouping would add a layer that classifies nothing. The reasoning is in a code comment so it is not re-litigated later.
• status hoisted to the top level, so a consumer branches on it rather than on issues.length. Reading "no issues parsed" as "passed" is precisely the failure mode the text format invited; a test pins it.
• --json owns stdout entirely — one stray human line makes the document unparseable. --claude-native output still writes through, since suppressing another tool's output would hide why a run failed.

Testing

• 170 pass / 0 fail; biome and typecheck clean.
• 3 new tests: clean report shape, failed status with issues present, and diagnostics with provenance flattened.
• Run against the real jdh-agents corpus: valid JSON, 67,895 bytes, and filesChecked (213 / 207) matches the text path exactly, so the two views cannot disagree.

Also adds "./report" to the package exports map — it had no entry, so tests could not import the builder.

Risk surface

Low and additive. The default (no --json) path is byte-identical; exit codes are unchanged in both modes. The one shared-code change is buildCheckReport reading MarketplaceCheckResult, which it does not mutate.

Note this is a feat:, so merging cuts 0.4.0 — and it is the first release since the npm job landed, so it will be the first real exercise of publish-npm. That job has never run; if it fails, the release assets are already attached by then and only the npm half is affected.

Rollback

Revert the commit. --json disappears; the text path and every exit code are untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LxNdWk6ZUzq6uWFtd94yWD

[github-actions]

🎉 This PR is included in version 0.4.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀