seal Wire DTOs with #[non_exhaustive] (enforces builder-only external construction)

Applies the CODING_PRACTICES "builder is the only path" principle at
the type-system level. Ten key Wire DTOs now forbid raw struct-literal
construction from external crates:

  WireCalibrateRequest       WireSweepGrid
  WireCalibrateResponse      WireSweepRequest
  WireCodecParams            WireSweepResult
  WireTensorView             WireSweepResponse
  WireTokenAgreement         WireTokenAgreementResult

External callers (hypothetical downstream consumer crates) are now
forced through one of these paths to construct these types:

  1. serde deserialize — JSON/YAML at REST/gRPC ingress (the intended
     path per Rule F "serialise once at edges only")
  2. TryFrom<WireCodecParams> for CodecParams — the shipped validated
     conversion that runs precision-ladder + overfit guard
  3. Future Builder::build() if one is added for a specific DTO

Internal construction (tests in wire.rs, grpc.rs conversion code,
serve.rs handler body) is UNAFFECTED — #[non_exhaustive] only
gates external-crate callers. Same-crate code retains struct-literal
access.

Why this matters in practice:

  - `WireCodecParams { subspaces: 6, centroids: 0, ... }` compiled
    today (skipping the ZeroDimension guard). External users can now
    only get a CodecParams through the TryFrom conversion, which
    runs the full validation chain at ingress.

  - Future new fields on these DTOs won't break external callers
    (they were already non-exhaustive-forbidden from raw struct
    literals), so downstream rebuilds don't need coordinated updates.

  - The "object does the work" principle now has teeth — the type
    system enforces what the docs say.

Test Plan:
  - cargo test --features lab --lib:   118/118 pass (unchanged)
  - cargo clippy --features lab -- -D warnings:   CLEAN
  - No internal construction path broken (tests + grpc.rs +
    serve.rs handler all inside the crate)

Also in this commit (cherry-picked from orphan branch state that was
not in the #239 merge):

  - scripts/codec_sweep.sh: Codex P2 fix — stub honesty check now
    exits 3 on missing/false flag instead of just logging. Script
    actually enforces the anti-#219 safeguard it documents.

  - CODING_PRACTICES.md: polyfill chain diagram + mandatory cargo
    clippy + feature-matrix discipline section (~131 LOC).

Cross-ref: CODING_PRACTICES.md anti-pattern #10 "Raw struct literals
bypassing builders"; session epiphany "the object does the work";
Codex P2 review 2026-04-21 on the stub honesty script.

https://claude.ai/code/session_01SbYsmmbPf9YQuYbHZN52Zh

Author: claude

crates/cognitive-shader-driver/src/wire.rs

@@ -145,6 +145,7 @@ pub struct WireTensorsResponse {
 /// object after ingress — per Rule F, there is no second deserialise anywhere
 /// in the pipeline after the handler consumes the request.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireCalibrateRequest {
     pub model_path: String,
     pub tensor_name: String,
@@ -183,6 +184,7 @@ fn default_cal_iters() -> usize { 20 }
 fn default_icc_samples() -> usize { 512 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireCalibrateResponse {
     pub tensor_name: String,
     pub dims: Vec<u64>,
@@ -246,6 +248,7 @@ pub struct WireResidualSpec {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireCodecParams {
     pub subspaces: u32,
     pub centroids: u32,
@@ -348,6 +351,7 @@ impl TryFrom<WireCodecParams> for CodecParams {
 // ═══════════════════════════════════════════════════════════════════════════
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireTensorView {
     /// [rows, cols] in elements (not bytes). Actual byte size inferred from lane_width.
     pub shape: [u32; 2],
@@ -955,6 +959,7 @@ pub enum WireBaseline {
 /// `top1_rate = 0.0` and `candidate_latency_us = 0`. D2.1–D2.3 land the
 /// real decode-and-compare loop.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireTokenAgreement {
     /// Model root directory (safetensors + config.json). Passed to
     /// `auto_detect::detect` to infer lane width + architecture defaults
@@ -974,6 +979,7 @@ pub struct WireTokenAgreement {
 
 /// `POST /v1/shader/token-agreement` response.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireTokenAgreementResult {
     /// Top-1 token-match rate across the full prompt set. Pass gate: ≥ 0.99.
     pub top1_rate: f32,
@@ -1049,6 +1055,7 @@ pub enum WireMeasure {
 /// × |distances| × |lane_widths|. Clients SHOULD keep the product ≤ a few
 /// hundred to fit in one JIT kernel cache warm-up round.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireSweepGrid {
     #[serde(default = "default_subspaces_axis")]
     pub subspaces: Vec<u32>,
@@ -1131,6 +1138,7 @@ impl WireSweepGrid {
 /// `POST /v1/shader/sweep` request. Client submits one grid + a measure
 /// set; server enumerates + calibrates + token-agreements each grid point.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireSweepRequest {
     pub tensor_path: String,
     pub grid: WireSweepGrid,
@@ -1156,6 +1164,7 @@ fn default_measure_set() -> Vec<WireMeasure> {
 /// One grid-point result, streamed by the sweep handler. Carries the
 /// candidate that produced it + optional per-measure payloads.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireSweepResult {
     /// Zero-based grid index (0 .. grid.cardinality()).
     pub grid_index: u32,
@@ -1179,6 +1188,7 @@ pub struct WireSweepResult {
 /// `POST /v1/shader/sweep` response for batch (non-streaming) clients.
 /// Streaming clients receive one `WireSweepResult` per SSE event instead.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct WireSweepResponse {
     pub label: String,
     pub cardinality: u32,