feat(coord): supervisor CLI + v1 NDJSON events + Prometheus exporter + doctor row (#347)

[mercurialsolo]

PR7 of the supervisor RFC (#342). Closes #347 (per issue title; numbering swap noted in earlier PRs).

Stacked on #355 — will retarget to main once #355 merges.

The user-facing surfaces: operators can see what the supervisor is doing; CI gates / dashboards consume a frozen event schema; Grafana scrapes a Prometheus exporter.

`claudectl supervisor` subcommand (RFC §10)

New top-level subcommand tree:

Verb	Purpose
`run <tasks.toml>`	Parse RFC §4 `[[task]]` blocks (incl. nested `[[task.verify]]`) and insert one row per task. `--dry-run` prints what would happen.
`submit`	One-shot inline form: `--name --cwd --prompt --role ...`
`status [--state STATE]`	Compact task table
`logs <task_id>`	Task detail + full transition log
`cancel <task_id>`	Idempotent move to CANCELLED
`drain` / `undrain`	Sentinel file at `~/.claudectl/coord/drain`; surfaces in doctor row

Hand-rolled TOML reader limited to the subset RFC §4 declares (no new dependency); rejects unknown keys.

v1 NDJSON event schema (`src/coord/events.rs`)

Frozen contract. `{v: 1, type, at, ...payload}` envelope with three event families:

• `task.transition` — state-machine move
• `task.verification` — verifier verdict + cost
• `task.escalated` — NeedsHuman move with reason + addressed_to

Additive-only forever: new event types are added; existing ones never rename fields.

Prometheus exporter (`src/coord/exporter.rs`)

Hand-rolled HTTP listener (no web framework dep) serving `/metrics` in Prometheus text format. Worker thread per scrape so the headless tick loop never blocks. Exposes:

• `claudectl_tasks_by_state{state}` — gauge
• `claudectl_fleet_cost_usd_total` — counter (attempt + verifier spend)
• `claudectl_retries_total{cause}` — counter
• `claudectl_verifier_pass_rate{kind}` — gauge [0.0, 1.0]

Label escaping handles `\`, `"`, `\n` per Prometheus spec.

Doctor row

`supervisor drain` — Pass when no drain marker, Advisory with the unstick hint when set.

Verification

```
cargo check / clippy / fmt — both feature sets, all green
cargo test --all-targets → 769 + 780 + 78 + 8 = 1635 pass
```

New tests cover:

• TOML parse: full block with verifier list; multi-task file; rejects unknown keys
• Event schema: round-trip per family; field shape verified by string inspection (so contract changes show up as test diffs)
• Exporter: state bucketing, Prometheus format, label escaping, division-by-zero safety

Out of scope (next commit)

• Wiring the exporter into `run_headless()` with the `--exporter :9464` CLI flag.
• Emitting v1 events from the reconciler/actuator into the `--watch --json` stream.
• `SupervisorPhase` in the init wizard.

These three together are about 100 lines of plumbing on top of what this PR ships; the surfaces here are reviewable standalone.

Test plan

• After merge: `claudectl supervisor submit --name x --cwd $PWD --prompt do_x` → row in `tasks`; `claudectl supervisor status` lists it.
• `claudectl supervisor logs <task_id>` shows the CREATED → PENDING transition.
• `claudectl supervisor drain && claudectl doctor` shows the new Advisory row.
• Write a 2-task `tasks.toml` with a verify block; `claudectl supervisor run tasks.toml --dry-run` lists both; without `--dry-run` actually inserts.

🤖 Generated with Claude Code