chore: add a justfile that mirrors the CI gate

[arcjet-rei]

gravity had no single command for running the CI gate locally; each step had to be copied out of .github/workflows/ci.yml. This adds a justfile in the style of the other Arcjet repos.

just check runs lint, build, test, test-go and test-cli, the steps in ci.yml in the same order. lint also checks the justfile's own formatting. just clippy exists but is not part of check, because CI does not run clippy. just update-snapshots, just format and just clean-examples cover the other routine tasks.

The recipes unexport RUSTUP_TOOLCHAIN and CARGO_TARGET_DIR. The first would replace the toolchain pinned in rust-toolchain.toml. The second would move the target directory that examples/generate.go reads from, and go generate would then fail.

AGENTS.md now points at the recipes.

🤖 Generated with Claude Code

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Needs Review

Rationale: This PR adds a new local command runner that is intended to mirror the CI gate and updates contributor guidance to use it. There are no apparent security issues, no secrets, and no escalation triggers fired. However, I am not confident the new Go-related recipes will work from the repository root: the existing AGENTS.md command ran Go generation and tests from the examples directory, while the new justfile runs go generate ./... and go test ./... from the justfile directory. If the Go module is under examples/ and there is no root go.mod or go.work, these recipes may fail and just check would not actually mirror CI.

Summary of Changes

Adds a root justfile with recipes for formatting, linting, building, Rust tests, Go example generation/tests, CLI snapshot tests, snapshot updates, and cleanup. Updates AGENTS.md to document just check and related recipes.

Review Focus Areas

• Should the Go generation recipe run from examples/ rather than the repository root?
  The previous documented verification command used (cd examples && go generate ./... && go test ./...); running go generate ./... from the root may fail if the Go module/workspace is not rooted there.
• Should the Go test recipe run from examples/ or otherwise set the working directory to match CI?
  just check is intended to mirror CI, so the Go commands need to use the same module context and working directory as the workflow.

_{Review: cce799ba | Model: openai/gpt-5.5 | Powered by Arcjet Review}