suit inject: resolver + materializer + lockfile write #67

Slice (a) of the suit inject proposal: docs/proposals/2026-05-24-realtime-component-injection.md (PR #66). The core, on which (b)(c)(e) depend.

Scope

• New suit inject verb. Resolve a component (skill/hook/accessory/bundle) from the configured content path (default) or --from <path-or-url>, reusing the existing 3-tier discovery + resolver.
• Materialize it into the target harness home (reuse writer.ts / compose.ts TARGET_PROJECT_PREFIX). Idempotent: sha256 match → disk no-op.
• Refuse-when-dirty per ADR-0012: untracked-at-path or sha256-mismatch → refuse unless --force.
• Lockfile: append to a NEW injected: [] list in .suit/lock.json + file rows (path/sha256/sourceComponent/mode) + per-component injectedAt. Create a minimal lockfile if none exists (worker launched via stateless prepare).
• --dry-run (resolve + report, write nothing), --no-reload, --json.

Out of scope

• Target discovery / NATS signaling (slice b, c). This slice materializes against a resolved harness-home path; the reload signal is a later wire-up.

Acceptance

• suit inject --skill <name> --from <dir> writes the skill into a given harness home idempotently and records it under injected: in the lockfile.
• Re-running is a no-op; editing the file then re-running refuses without --force.
• --dry-run writes nothing; --json emits a machine-readable result.
• Unit tests cover: fresh inject, idempotent re-inject, refuse-when-dirty, minimal-lockfile creation.

Kickoff prompt

You are implementing slice (a) of suit inject. Read docs/proposals/2026-05-24-realtime-component-injection.md in full first. Add a `suit inject` verb (src/ac.ts dispatch + a new src/lib/ac/inject.ts). Reuse the existing resolver (resolution.ts), writer (writer.ts), target-prefix map (compose.ts), and lockfile module (lockfile.ts) — do NOT duplicate materialization logic. Add an `injected: []` list to the Lockfile interface (lockfile.ts) alongside resolution/files; bump nothing else in the schema. Honor refuse-when-dirty (ADR-0012). TDD: write failing tests in src/tests/ for fresh/idempotent/dirty/minimal-lockfile cases before implementing. Do NOT wire NATS targeting or reload here — accept a resolved harness-home path. Run npm run typecheck && npm run build && npm test locally before pushing. Feature branch → PR referencing this issue. Never push to main.