Add workspace path parameter to git operations (#81)

## Summary
This PR adds support for specifying a custom git workspace path,
allowing the linter to operate on repositories outside the current
working directory. The workspace path is now threaded through git
operations and rule implementations.

## Key Changes
- Added `--workspace` CLI flag to specify a custom git workspace path
(defaults to current working directory)
- Added `workspace` field to `Run` struct with a helper method
`workspace()` to access it as `Option<&Path>`
- Updated git operation calls to pass the workspace parameter:
  - `git::repo_workdir()`
  - `git::tracked_files()`
  - `git::modified_since()`
  - `git::get_upstream_content()`
- Updated rule implementations to use the workspace parameter:
- `never_edit` rule now passes workspace to all git operations and
`build_restore_replacement()`
- `if_change_then_change` rule now passes workspace to
`git::modified_since()`
- Updated `build_restore_replacement()` function signature to accept
workspace parameter

## Implementation Details
- The workspace parameter is optional (`Option<&Path>`) to maintain
backward compatibility
- The workspace path is properly propagated from CLI through `Run`
struct to all rule functions
- Git operations can now be anchored to a specific workspace rather than
always using the process's current working directory

https://claude.ai/code/session_01Lgu6orj3bmLdAWh1qisrua

Co-authored-by: Claude <noreply@anthropic.com>

Always write results file, even on catastrophic failure (#80)

## Summary
Refactored the output pipeline to guarantee that the `--results` file is
always created, even when toolbox encounters catastrophic failures like
config parsing errors. This honors the contract with trunk-check, which
expects the output file to exist and be readable.

## Key Changes
- **Extracted `build_output()` function**: Separated the rule pipeline
execution from output file writing, allowing failures to be caught and
handled gracefully while still producing valid output.
- **Fallback SARIF generation**: Added `fallback_output_string()` and
`minimal_error_sarif()` functions to synthesize minimal but valid SARIF
documents when the normal pipeline fails. Includes a constant
`EMPTY_SARIF` for the most minimal case.
- **Rule failure handling**: Changed rule failures from aborting the
pipeline to converting them into error-level diagnostics with rule ID
`toolbox-rule-error`. Failed rules are collected and surfaced as a
non-zero exit signal at the end.
- **Guaranteed file creation**: The `run()` function now always writes
the output file (or prints to stdout) before returning, ensuring the
`--results=${tmpfile}` contract is honored even on config load failures.
- **Comprehensive test coverage**: Added `results_file_contract_test.rs`
with three tests validating:
  - Clean runs create valid SARIF files
  - Malformed config still creates a results file with error diagnostics
  - Text format output also respects the file creation contract

## Notable Implementation Details
- Error handling uses `anyhow::Result` with context for better error
messages
- The fallback SARIF builder bypasses `serde_sarif` intentionally (since
that builder may have been the source of failure)
- Individual rule failures no longer abort the entire pipeline; they're
logged and embedded in the output for downstream visibility
- Minor grammar fix in a comment ("If not configuration" → "If no
configuration")

https://claude.ai/code/session_01VcknDnkTbSagHn75UkZuic

---------

Co-authored-by: Claude <noreply@anthropic.com>

Add CLI validation for --results and --cache-dir paths (#78)

## Summary
Add early validation of command-line arguments to provide clear,
actionable error messages when `--results` or `--cache-dir` paths are
invalid, rather than failing with cryptic I/O errors during execution.

## Key Changes
- **Results path validation**: Check that the parent directory of
`--results` exists before running any rules. Fail fast with a clear
error message naming the flag and path if validation fails.
- **Cache directory validation**: Warn on stderr if `--cache-dir`
doesn't exist or isn't accessible, then continue without a cache rather
than failing. This treats cache as optional while results as required.
- **Test infrastructure improvements**: 
- Refactored `TestRepo::run_horton()` to support custom results paths
and cache directories via new `run_horton_customized()` method
- Introduced `ResultsMode` enum to cleanly distinguish between no
results, auto-generated temp file, and explicit paths
- Fixed git config to disable GPG signing in test repos to avoid
dependency on signing infrastructure
- **Error handling**: Improved error context when writing results files
using `with_context()`

## Implementation Details
- Validation happens early in `run()` before configuration loading or
rule execution
- `--results` validation is strict: missing parent directory causes exit
code 1
- `--cache-dir` validation is lenient: missing directory triggers a
warning but execution continues
- Test coverage added for both validation scenarios with regression
tests

https://claude.ai/code/session_011YchwokjBuvv6AGASg7BnP

---------

Co-authored-by: Claude <noreply@anthropic.com>

Claude/fix glob pattern matching 0 nw6g (#76)

Co-authored-by: Claude <noreply@anthropic.com>

Change runner to ubuntu-latest for release workflow

Add "no-curly-quotes" rule to the codebase. (#56)

Adds support for nocurlyquotes that will find instances of curlyquotes
in a file and replace with correct non-curly form. We had instances of
this in our code base and it caused some issues with marketing site.

Fun little rule. Interestingly - this rule exposes a bug in how we apply
on `trunk check` sarif fixes for utf-8 non-ascii characters. For now
this rule will stay disabled until we have a fix.

Fix bug where multiple fixes in a single issue were being turned into
multiple issues (which is not what the spec or code was intending to
do).

if-change rule should not run on upstream. it only cares about curren…

…t changes (#54)

1) if-change rule should not run on upstream. it only cares about
current changes
2) enable caching of trunk-toolbox runs

Memoize lfs check which was very expensive. (#53)

The LFS check should only be performed when necessary since it hits the
file system and we should memorize the result so we don't keep repinging
it.

Add more debugging code to the rules execution pathways (#51)

Add warning when config is invalid or not covering any files (#46)

1. Add warnings when the neveredit rule is not configured properly .
mostly when it's not checking for anything but you think it should be
2. Updated tool to only emit config issues when checking current (and
not the upstream) - allows it to effectively bypass HTL for config
issues.
3. Update some deps for security reasons