refactor(repo): move the dev-install symlinking into its own guarded script

[azlekov]

D-0004 guarded the whole justfile. It is the only guard in the repo pointing at a multi-purpose file — every other one names a Rust module, a workflow, or a single-purpose install script:

D-0004  cli/dira/src/update/replace.rs
D-0004  install.sh
D-0004  install.ps1
D-0004  justfile          ← ~6 of 190 lines are actually D-0004's business

So it fired on every unrelated recipe. It tripped while editing pricing-sync, which fetches model prices from models.dev and has nothing to do with installs.

Why this is more than noise

The guard wall requires a decision trailer on any commit touching a guarded path — I confirmed a justfile-only edit with no trailer is blocked locally and in CI:

$ printf 'justfile\n' | zavet gate --paths-from - --message "chore(repo): tweak a recipe" --guards-only
Staged changes touch paths guarded by: D-0004. Reference the decision in the commit message with a trailer...
exit=1

So unrelated justfile edits had to cite D-0004 in their commit message, polluting git log --grep D-0004 and training readers to skim past a guard that is usually irrelevant.

Why the guard is not simply dropped

The protection is real. Nothing else in the repo would notice just link changing from ln -sf to cp — and that change would leave a dev install indistinguishable from a managed one, silently defeating every refusal D-0004 describes (discover_install reads the PATH entry with symlink_metadata precisely because current_exe() resolves symlinks away).

So the symlinking moves into dev-install.sh and the guard follows it there. Every path D-0004 now names is install-path logic end to end, and the invariant is documented at the edit site rather than three files away.

Two things that fall out of it

• Lint coverage. The dev-install symlinking is install-path logic that had been escaping the shellcheck/shfmt standard this repo already applies to install.sh, purely by hiding in a justfile. The shell-lint job now covers both. (The job's name changes; develop has no branch protection, so no required-check breakage.)
• A missing-build check. The inline recipe would happily ln -sf a binary that had not been built, leaving a dangling symlink on PATH. The script fails with a message pointing at just release.

Verification

just ci passes. shellcheck -s sh and shfmt -d -s -ln posix -i 2 clean on both scripts.

Guard matching flipped as intended:

zavet match justfile        → (nothing)
zavet match dev-install.sh  → D-0004
zavet match install.sh      → D-0003 D-0004 D-0007 D-0014 DIRASH-0029

just link produces byte-identical symlinks — tested against a scratch bin dir (never ~/.local/bin), along with idempotent re-runs, the missing-build path, and missing arguments.

🤖 Generated with Claude Code

[github-actions]

Knowledge layer

Check	Result
Decision checks	passed
Guard trailers	passed

Spec currency is reported in the job summary and never fails a build, the same severity the local pre-commit hook uses.