deps group: dev deps update | install | check | path (#189)

[JPDuchesne]

Closes #189. Builds on the command tree (#188, 0.2.88).

What

update-deps, install-deps, check and deps path were four verbs on one subsystem spread across three top-level names and one noun. They are now one Lifecycle noun with Bundler's verbs:

dev deps update              # was update-deps   ≈ bundle update
dev deps install             # was install-deps  ≈ bundle install
dev deps check               # was check         ≈ bundle check (inspect + exit non-zero when stale)
dev deps path <int> <name>   # unchanged

• runner.rb: one CommandGroup with four leaves; the flat registrations are gone. up keeps composing the same InstallDepsCommand instance. Per-leaf flags unchanged (all four staleness_exempt?, only install stamps). PROJECT_EPILOGUE → dev deps update.
• Every generated header and remediation message names the new verb: Gemfile (BundlerLocker), deps.lock/build-deps.lock (Lockfile), deps.cmake/deps.targets.cmake (CmakeIntegration), data/Deps.cmake guard, Accessor::NotLockedError, Staleness, BundlerRepository, Fetcher, ficsit/steam/gh integrations. Committed lockfiles re-render their header on each repo's next deps update — one line of churn, once.
• Docs: README (Built-in commands table, Dependency commands, Adoption rung 3, Ruby resolution, tree example), docs/deps-architecture.md, .cursor/skills/{learnings/command-runner-exec,architecture/hook-points}, .cursor/rules/learnings-index.mdc, .gitignore comment, code comments.

Hard cut, deliberately

The flat names fall through to Command 'update-deps' not found (tested). No aliases: the only dev consumers are this org's humans and CI, and every caller is updated in lockstep with the release (list below). runner-setup stays as is — its retirement is #184.

Lockstep after release (separate PRs, ai-flow first)

repo	callers
ai-flow	.github/workflows/origin-firing.yml:82, ai-commands.yml:339 (dev install-deps) — the reusable check every org PR runs, so first
cellbound-3d	bin/setup.rb:57 (dev up runs it), docs/build-and-tooling.md, dependencies.rb comments; lock headers
snappy	bin/setup.rb:25, comments in dev.yml/dependencies.rb/Dockerfile; lock headers
unreal-engine	.github/workflows/release-engine.yml:352-356; README/dependencies.rb comments
knowledge	skills/ruby-toolchain/SKILL.md:48,72
ai-cipher, math-tables	dependencies.rb/README comments; Gemfile header
cellbound	delete the dead update-deps: override + bin/update_deps.rb

Between the release and the ai-flow merge, origin-firing fails on every org PR; the caller PRs pass on their own branch because dev-box-setup runs the checkout's bin/setup.rb.

Acceptance (from #189)

• dev help Lifecycle lists up, deps, runner (no update-deps / install-deps / check rows)
• dev deps prints the group usage; dev deps update|install|check|path behave as their predecessors
• Only deps install (and up) stamps; all four deps leaves skip the staleness guard
• Generated lockfile headers and error messages name dev deps update
• Org callers updated; cellbound override deleted — after release, PRs above

Verification

• dev test: 1506 tests; 4 pre-existing failures in BuildContainerTest on this machine only (/Users/Shared/dev/engines vs ~/.dev/engines install-dir config; fail identically on main).
• srb tc clean, dev style clean.
• Not touched: the remediation string in Fetcher#fetch_missing — that method is dead (calls Lockfile.parse / check_sync! / dep_pin / runtime_ref_map, none of which exist; only caller is parked cellbound). Deleting it is a separate cleanup.
• Smoke via bin/dev: dev deps / dev help deps check / root listing (deps … row, epilogue) / dev update-deps → not found, exit 1 / dev deps check → stale message, exit 1 / dev complete deps → check install path update.

Made with Cursor

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!