oclif runner and core-plugin host (FR-025)

[kreneskyp]

Adds the oclif entry points a consuming CLI needs to run — run, execute, loadConfig, listCorePlugins — so a binary composed per FR-010 ships a thin bin script instead of re-deriving oclif wiring. The runner is a wrapper over @oclif/core: command and core-plugin discovery are oclif's own Config loader, with no registry or manifest loader of our own, and no @oclif/plugin-plugins (runtime user-installed plugins stay out of scope).

This unblocks @agent-ix/quoin, whose oclif migration imports run and loadConfig and cannot resolve them from any published version — 0.11.0 is the newest on npm and has neither. quoin's branch is otherwise green against a local build of this one (116 passed, 100% coverage), so this needs to land and publish before that can proceed.

Review findings, fixed here

The new API had no owning requirement. runner.ts, index.ts, and base-command.ts each cited FR-015, which in this repo is "Service Discovery Client". (The pre-existing FR-015..FR-018 citation on the auth engine is correct and untouched.) Adds FR-025 "oclif Runner and Core-Plugin Host", following how this repo specs API surfaces — FR-001 ConfigService, FR-005 SecretsService — tracing to StR-003 with FR-010 downstream.

FR-025 was already spoken for, wrongly. index.ts and plugins/schema.ts pointed the ixSchema convention at FR-025, and a plugin-schema test was named for it, though that convention is FR-014. Repointed all three, so one ID no longer means two things.

Two ACs had no test:

• listCorePlugins excluding the root host plugin — the host is itself a plugin in oclif's graph, so including it would misreport the host as its own dependency.
• run() rejecting rather than calling process.exit, which is exactly what makes it safe to drive from a test.

Traceability

spec/tests.md gains rows for all eight ACs. Six quoted test names verified to resolve to real tests; AC-8 is a static check, confirmed (no @oclif/plugin-plugins dependency). Also adds runner.test.ts to the test-file map, FR-025 to the StR-003 rollup, and indexes FR-024, which was missing.

Note for reviewers

@oclif/core moves from peerDependencies to dependencies. That's deliberate but worth a look: a consumer that also depends on @oclif/core (quoin does) could end up with two copies and two Config classes. Today both resolve the same 4.11.4 in quoin's store because the ranges overlap, so there's no live problem — just keep the ranges compatible.

Verification

245 passed / 1 skipped, tsc --noEmit clean, lint clean, quire validate exit 0 over spec/.

🤖 Generated with Claude Code