aletheia: 27/29 integration tests fail — main.rs never wires up the CLI surface

[hyperpolymath]

Split out of #123, which added the first-ever Rust CI for aletheia and deliberately
left this ungated rather than shipping a hollow green job.

Measured

cargo test --bins                 ->  26 passed,  0 failed
cargo test --test integration_tests ->  2 passed, 27 failed

Root cause — one cause, not 27

tests/integration_tests.rs (823 lines) exercises a CLI that does not exist.
src/main.rs parses exactly two flags:

"--json"  => OutputFormat::Json,
"--sarif" => OutputFormat::Sarif,

The tests expect --help, --version, --format=, --verbose, --badge, --html,
--init-hook, config-file handling and ignore patterns. aletheia --help returns
Error: Invalid repository path. and exits 1.

The crate is 962 lines across 5 modules, but main.rs is only 117 of them. The
dead-code warnings show which modules are orphaned:

• checks.rs — glob_match, glob_match_recursive, check_path_security, file_exists
• config.rs — parse_toml, TomlValue
• types.rs — PathCheckResult, add_warning, ComplianceLevel::{Gold, Platinum}

So the code was split into modules and main.rs was never rewired. The test suite reads
as a specification of the intended tool, not a description of the current one.

Secondary defect

The tests shell out via Command::new("cargo").args(["run", ...]). That spawns a nested
cargo inside cargo test — fragile under build-lock contention and shim interception.
The idiomatic form is env!("CARGO_BIN_EXE_aletheia"), which points at the already-built
binary. Worth fixing while the tests are being addressed either way.

Decision needed

Either implement the missing CLI surface, or rewrite the tests to match the tool as it
actually is. This is a product decision.

Once green, add to root rust-ci.yml as a blocking job. Do not add it with
continue-on-error.