fix(guard): README CLI-count check did a 14-minute build, then failed printing nothing

[noahgift]

Why this is urgent

guard-runner-labels fails on every merge_group run, and it is required by gate. So no PR can merge. #2533 has been evicted three times; after the cargo-audit fix cleared ci / security, this was the last remaining red.

The job log is the whole story:

PASS FALSIFY-README-001 crate_count: 78
PASS FALSIFY-README-002 contract_count: 1772 (1 claim(s) checked)
PASS FALSIFY-README-004 cookbook_link: present
##[error]Process completed with exit code 1.

FALSIFY-README-003 printed nothing — no PASS, no FAIL, no reason — with a 14-minute gap where it ran.

Two defects

1. The measurement did a full build, from a step documented as text-only.

measured_cli_command_count ran cargo run --quiet -p apr-cli --bin apr -- --help. ci.yml invokes this script from a bare, non-container run: step whose own comment reads "Text-only, no build" — and cargo is not reliably on PATH for raw run: steps on these runners (the same hazard is documented in coverage-nightly.yml).

It now counts from contracts/apr-cli-commands-v1.yaml §commands. That is the designated registry for this surface, and its equivalence to the real binary is already enforced: FALSIFY-CLI-001 (every listed command answers --help) and FALSIFY-CLI-002 (every command in apr --help is listed), both in cargo test -p apr-cli --test cli_commands on the integration line. The guarantee is preserved; the build is gone. If the two ever diverge, CLI-001/002 fail — which is where that defect belongs.

Parsed as YAML rather than grepped: grep -c '^ - name:' reports 111 because other same-indent name: keys exist, as the contract's own prose warns.

2. A failed measurement returned silently.

measured=$(measured_cli_command_count) || return $?

No message on any path. That is why the log had a hole instead of a diagnosis. A measurement that cannot run is its own failure mode and must say so — same lesson as the coverage-nightly blank-percentage fix.

Verification, including mutations

case	result
baseline	rc=0 in 0s, all four PASS, cli_command_count: 105 (was 14+ min, then red with no message)
README drift (105→999)	FAIL … README claims 999, contracts/apr-cli-commands-v1.yaml lists 105 commands
broken measurement	FAIL … MEASUREMENT FAILED (rc=1) … This is a broken check, not a README drift; do not 'fix' the README.
restored	rc=0

The middle two are the point: drift and broken-measurement are now distinguishable, so nobody "fixes" a correct README to silence a broken check.

The measured value is unchanged at 105, matching both the README claim and a local apr --help count on this same commit.

bashrs: 0 errors before, 0 after.

Also corrected the ci.yml comment, which asserted "no build" while the step was doing one — that stale claim is a large part of why this was hard to spot.