sc-lint 0.4.0 lint_sc_boundary.py runs 'cargo run -p sc-lint-boundary' against consumer workspace instead of installed binary

[randlee]

Root-caused during PR #358 review (FIX-358-REVIEW-ROOTCAUSE, comp2, 2026-08-11), replacing what every prior Phase K/L sprint treated as an unexplained "known pre-existing sc-boundary/sc-lint#84 gate."

Root cause

setup-sc-lint (the CI setup action) installs the sc-lint-boundary binary into the consumer workspace, but the pinned sc-lint 0.4.0 release's .just/lint_sc_boundary.py invokes it via:

cargo run -p sc-lint-boundary

sc-lint-boundary is a workspace member of the sc-lint tool's own repo, not of consumer workspaces like sc-compose (whose root Cargo.toml correctly only has sc-compose/sc-composer/sc-compose-py as members — this is not a bug in sc-compose). cargo run -p sc-lint-boundary fails with:

error: package(s) `sc-lint-boundary` not found in workspace `<consumer-repo-root>`

surfaced by the CLI as CLI.BACKEND_EXEC_FAILURE, causing just lint (and CI's "Run shared sc-lint contract" step) to fail on every platform, every sprint, since this was introduced.

Verification

• Running the installed sc-lint-boundary binary directly against sc-compose passes with 0 findings (also confirmed for sc-lint-portability).
• This is not fixable from the consumer side by registering a package — the source for sc-lint-boundary isn't vendored into consumer workspaces, only its compiled binary is installed.

Fix

lint_sc_boundary.py (or the sc-lint release itself) needs to invoke the already-installed sc-lint-boundary binary directly (e.g. resolve it from PATH/cargo-install bin dir) instead of shelling out to cargo run -p sc-lint-boundary in the consumer's workspace.

This is an sc-lint tool/release defect, not an sc-compose defect. No sc-compose PR should continue to carry this as a "known non-blocking" CI red herring once this is fixed upstream.

[randlee]

Peer upstream issues (sc-lint)

• full/ci lint profiles: sc-boundary/sc-portability steps broken for external consumers (cargo run -p sc-lint-boundary against consumer workspace) sc-lint#84 — full/ci profile steps still shell out to .just/lint_sc_boundary.py/lint_sc_portability.py (this issue's root cause), instead of the native CommandId::LintScBoundary/LintScPortability dispatch already used by single-target invocations. Fix location: crates/sc-lint/src/workflow.rs::lint_profile_plan.
• identity-literals crashes on valid Rust unicode escape literals sc-lint#88 — separate defect hit once past Sprint B8: Cross-Use-Case Proof By Implemented Examples #84 locally: identity-literals crashes on a valid Rust \u{feff} unicode escape (Python unicode_escape codec can't decode Rust brace-form escapes). Must also be fixed/released before the full profile is clean end-to-end.

Current interim state in this repo

CI temporarily runs just lint-ci-consumer (see Justfile) instead of just lint (.github/workflows/ci.yml), which runs only the native fast/sc-boundary/sc-portability/line-counts targets + cargo deny/cargo shear, and explicitly skips identity-literals. This is a scoped, non-destructive substitution — no sc-lint internals were patched, no fake Cargo workspace members were added.

Exact repair steps once sc-lint#84 + sc-lint#88 are fixed and released

1. Bump the pinned version in two places:
   • sc-lint.toml — version = "0.4.0" → new released version.
   • .github/actions/setup-sc-lint/action.yml — inputs.version.default: "0.4.0" → same new version.
2. In .github/workflows/ci.yml, revert the "Run shared sc-lint contract" step from run: just lint-ci-consumer back to run: just lint (defaults to the full target).
3. In Justfile, remove the lint-ci-consumer recipe and its explanatory comment block entirely.
4. Run just lint locally against a clean checkout and confirm it passes, including identity-literals, before opening the restore PR.
5. Close this issue once that PR merges to develop with green CI on all 3 platforms.

No sc-compose boundary/portability rule definitions (boundaries/**/*.toml) need to change for this — the defect and its fix are entirely on the sc-lint side; this repo's TOML-driven boundary config is unaffected and does not need re-authoring.