feat(scan): detect the real environment, and make the drift loop work without FUSE

[kridaydave]

What this is

taproot scan fills a state file in from what a project actually declares, and mount --no-fuse materializes the mounted tree into a real directory so the v0.1.0 drift loop runs without /dev/fuse.

The signed-envelope machinery was already here and works well. What was missing was the two ends: nothing produced a state worth signing, and the drift loop could not be exercised anywhere without a kernel module. With those in place, init is the fallback path rather than the only one.

The loop, end to end

Every command above exits 0. Nothing here needs /dev/fuse.

Commits

Each one is independently useful and builds on the last.

88ecdc4	The verify_fails_on_wrong_key test did not test what its name said. It built a scenario, commented in prose that it would pass, discarded it, and asserted something else.
dd43373	check --baseline X --state-path X compared a file to itself and reported no drift with exit 0. CI was never affected, since run.sh uses a separate temp file, but the CLI gate was a no-op for anyone who passed the same path twice.
341b994	--no-fuse wrote nothing, so the drift loop was unreachable in any container or CI runner, and the README documented it as the way to try the tool. It now writes the same tree the kernel mount serves; sync --from-dir reads it and delegates to the existing sign-and-adopt path.
8dedf6e	scan itself. Reads .tool-versions, .mise.toml, Dockerfile FROM lines, package.json engines, and compose files.
5ea2398	registry log returned one entry and a comment admitted there was no chain. push now links each object to the one it superseded.
d48a668	README: three quickstart commands did not work as written.
45cb09b	README: dropped an unverifiable stat.

Two decisions worth arguing with

scan never reads the process environment. A state file gets committed, so harvesting whatever happens to be exported would publish credentials. .env reading is opt-in via --include-env, and any value whose key name or shape reads as a credential is skipped and reported rather than stored. DATABASE_URL is not a secret; sk_live_ and ghp_ prefixes and PEM private key blocks are. Step 01 above shows STRIPE_SECRET being refused.

A tag that names no version is not a pin. FROM postgres and golang = "latest" are skipped rather than recorded as latest, since a floating tag is not an inherited environment. Tool names are canonicalized, so nodejs in .tool-versions and node in package.json do not become two runtimes for one tool.

Verification

cargo test    106 passed, 0 failed   (was 69)
cargo clippy  clean except one pre-existing warning in fabric.rs
cargo fmt     clean

scan and the fuseless loop are covered by integration tests, including that a secret never reaches the state file. The whole flow was also run end to end against the release binary; the output above is that run, not a reconstruction.

Tests went 69 to 106. Nothing existing was removed or weakened.

The last commit

45cb09b touches the stats citations. The 68% figure was attributed to "DevOps Research 2026", which I could not find, so it is gone. The other three now name the organizations they credit. If any of them are equally unverifiable, that commit drops cleanly on its own.

Not done

registry log history is local-only. There is no migration for refs that already exist, so branches pushed before this change have no parent link and still show a single entry. Content-addressed objects are never rewritten, so existing history is safe; the chain just starts from the first push after this lands.

Real FUSE mounting is untested here. /dev/fuse is blocked in this container, so everything above runs through the materialization path. The FUSE code path itself is unchanged apart from mount_readonly now taking &Path at an unchanged call site.