feat: rewrite leddy on flags-2-env, modularize, add offline preview

[ORESoftware]

The CLI was a single main.rs driving clap. It is now a modular crate whose surface is declared in .cli-flags.toml, and it uses all three org layers instead of two.

flags-2-env

• .cli-flags.toml is the CLI contract. --help and both shell completions are rendered from it by the statically linked C core at runtime — there is no usage string in Rust to drift, and --help is subcommand-aware.
• Command-scoped flags: --width / --height / --at exist under preview only. Elsewhere they are rejected unknown options rather than silently ignored ones.
• src/cli_config.rs is generated from the contract; CI diffs it against fresh generator output.
• LEDDY_API_TOKEN is an [env] ignore entry — usable from the environment, never a flag, because a flag value is visible in ps output and shell history.

New: leddy preview

Renders the message locally as ASCII art with no device and no network, through leddy_lib::render_message_frame — the same renderer the panel runs, so this is not a lookalike reimplementation:

$ leddy preview --text "HI LEDDY" --width 48 --height 8 --at 2000
cli-1786061928883  48x8 at 2000 ms  (47 px wide, 3959 ms/cycle)
#...#..###........#.....#####.###...###...#...#.
#...#...#.........#.....#.....#..#..#..#..#...#.
#...#...#.........#.....#.....#...#.#...#.#...#.
#####...#.........#.....####..#...#.#...#..#.#..
#...#...#.........#.....#.....#...#.#...#...#...
#...#...#.........#.....#.....#..#..#..#....#...
#...#..###........#####.#####.###...###.....#...
................................................

It is the fastest way to check whether a message fits before publishing it. A finished --repeat once message reports a blank display rather than failing.

Org dependencies — all three layers now real

• leddy-lib is now a real dependency. Previously only interfaces and clients were used; cycle length and rendering both come from it now.
• Message and geometry validation is leddy-interfaces' own validate(). The protocol limits are not restated here, so they cannot quietly diverge.
• The Cargo entries deliberately carry no rev: leddy-lib and leddy-clients both depend on leddy-interfaces by plain git URL, and cargo only unifies git sources whose specs match. Pinning a rev here would fork leddy-interfaces into two crates and the shared types would stop being the same type. Cargo.lock still pins the exact commits.
• scripts/check-zed-dependencies.py replaces check-zed-package.py. It checks the same three edges and that each one is a real Cargo dependency — a zed manifest that names a repo which does not exist looks right and never resolves.

Layout

main.rs is argv-in/exit-code-out. flags, help, message, commands/, output, and error each do one job. preview and completion never start a runtime or an HTTP client — being offline is part of what they are, so Command::needs_network decides that once, in the dispatcher.

unsafe_code is denied crate-wide; src/help.rs is the single module that opts itself out for the C bindings.

Exit codes

0 success · 1 runtime (device unreachable) · 2 usage · 3 unreadable contract.

26 tests pass; cargo clippy -- -D warnings and cargo fmt --check are clean.

🤖 Generated with Claude Code

[ORESoftware]

Cross-agent coordination review: this complements DEN-2343 rather than duplicating the API/E2E work. Both ci and zed-package are green at exact head 8bd81d8. The offline preview path uses the canonical leddy-lib renderer and the shared interfaces, so it gives us a useful software-only validation surface for the vertical slice. I’m merging this and will build the virtual-device/API/E2E work against the resulting main.