iris: the lint over a portal site, as its own repo

question_lint becomes `iris check`, needs_replay becomes `iris
replay`, and the needs module and local-checkout loaders come with
them. Portal is a library dependency pinned to the release iris
matches (v0.3.36), so every type iris reads is the site's own and the
two never disagree about what a page is. `iris --path questions`
still works, so a content repo's one-line CI needs only a new path.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

src/main.rs

@@ -0,0 +1,56 @@
+//! iris - the shield over a portal site. A content push is an incoming
+//! wormhole; nothing comes through until it checks out.
+//!
+//! `iris check` loads a content repo (a Gitea URL or a local checkout)
+//! exactly the way the running site does, validates it, and holds it to
+//! the business needs it declares in `needs.yaml` - a path within
+//! budget for every kind of visitor, a desk for every handling group,
+//! every finished state reachable, no record stranding. It also exports
+//! what a trainer needs to grade the wording: personas as typed choice
+//! tasks, and a resolved simulation model.
+//!
+//! `iris replay` runs simulated cases through the site's real aggregate
+//! engine on a JetStream and reports every bucket by state; with
+//! `--report-only` it takes the same scorecard from a live site's
+//! buckets.
+//!
+//! Every type iris reads is portal's own, pinned to the portal release
+//! it matches, so the lint and the site never disagree about what a
+//! page is.
+
+mod check;
+mod local;
+mod needs;
+mod replay;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let mut argv: Vec<String> = std::env::args().skip(1).collect();
+    // `iris --path questions` reads as `iris check --path questions`,
+    // so the content repos' one-line CI keeps working as it was.
+    match argv.first().map(String::as_str) {
+        Some("check") => {
+            argv.remove(0);
+            check::run(argv).await
+        }
+        Some("replay") => {
+            argv.remove(0);
+            replay::run(argv).await
+        }
+        Some("--version") | Some("-V") => {
+            println!("iris {} (portal {})", env!("CARGO_PKG_VERSION"), PORTAL_TAG);
+            Ok(())
+        }
+        Some(flag) if flag.starts_with("--") => check::run(argv).await,
+        _ => {
+            eprintln!(
+                "iris {} - matches portal {PORTAL_TAG}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
+                env!("CARGO_PKG_VERSION")
+            );
+            std::process::exit(2)
+        }
+    }
+}
+
+/// The portal release this iris was built against (see Cargo.toml).
+const PORTAL_TAG: &str = "v0.3.36";