lint: add pkh lint, wrapping lintian for parity plus pkh-native checks

pkh covered the package lifecycle but never validated the packaging
itself: broken control stanzas, unparsable changelog versions or
uncommitted debian/ edits only surfaced at build or upload time. pkh
lint lints a source tree with day-one lintian parity plus a native Rust
engine for the checks lintian cannot have.

The wrapper reuses the pkh build output next to the tree when it matches
the current changelog entry and no tree content is newer (mtime walk,
skipping .git/.pc), else packs fresh with dpkg-source -b using weak gzip
compression (the artifact is ephemeral; xz dominated the run at 9.8 s
versus 2.7 s on a 111 MB tree) and symlinks quilt orig tarballs from the
tree's parent, which dpkg-source searches in cwd. Findings are parsed
from the installed lintian into a unified report, deduplicated by tag
name against the native engine, and rendered lintian-shaped
(<L>: <pkg> <type>: <tag> <details>) as text or JSON, colorized at
render time (--color auto/always/never). Exit codes follow lintian's
contract (0 clean, 1 findings at/above --fail-on, 2 runtime error);
lintian's own exit code is ignored because it uses 2 both for findings
and for runtime errors. -d/--dist maps to lintian --profile so the
target distro's rules apply even on a foreign host.

The native engine hosts the first workflow check lintian cannot know:
pkh-debian-changes-not-committed flags debian/ content that is not
committed to git, since the pkh flow builds and uploads the tree as-is.
Checks register in a static registry validated by a unit test, and the
wrapper's parser is pinned by golden tests captured from lintian 2.129
output. Strategies for lintian's Ubuntu blind spots (its vendor data
there is one file plus 14 disabled tags) are specced in
plans/pkh-lint.md, deliberately not implemented yet.

src/lint/tag.rs

@@ -0,0 +1,85 @@
+//! Lint tag model: severities, certainties and static tag metadata.
+//!
+//! Tags are the atomic diagnostics of a lint run, named after lintian's
+//! model: a stable machine-readable name (`missing-debian-copyright-file`),
+//! a severity, a certainty and a description. Checks declare the tags they
+//! may emit as static [`Tag`] values; the wrapper's parsed findings carry the
+//! letter lintian printed instead.
+
+/// Severity of a finding, matching lintian's severity ladder.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Severity {
+    /// Policy violation or broken package data (`E:`).
+    Error,
+    /// Probable bug or policy deviation (`W:`).
+    Warning,
+    /// Informational note about packaging choices (`I:`).
+    Info,
+    /// Nitpick most packages may legitimately ignore (`P:`).
+    Pedantic,
+}
+
+impl Severity {
+    /// The output letter lintian displays this severity as (`E`, `W`, ...).
+    pub fn letter(self) -> char {
+        match self {
+            Severity::Error => 'E',
+            Severity::Warning => 'W',
+            Severity::Info => 'I',
+            Severity::Pedantic => 'P',
+        }
+    }
+
+    /// Lowercase name used in `--fail-on` values and JSON output.
+    pub fn name(self) -> &'static str {
+        match self {
+            Severity::Error => "error",
+            Severity::Warning => "warning",
+            Severity::Info => "info",
+            Severity::Pedantic => "pedantic",
+        }
+    }
+}
+
+/// How sure a check is that a finding is real. Not acted upon yet (a future
+/// `--fail-on error,certain` would consume it), but captured from day one so
+/// severity tuning is data-driven later.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Certainty {
+    /// The finding is a fact (e.g. a missing file).
+    Certain,
+    /// The finding is likely but has legitimate exceptions.
+    Possible,
+    /// The finding is a guess from weak signals.
+    WildGuess,
+}
+
+/// Static metadata of one tag: what checks declare and the renderer resolves.
+#[derive(Debug)]
+pub struct Tag {
+    /// Stable machine-readable name, lintian-compatible kebab-case
+    /// (`pkh-debian-changes-not-committed`).
+    pub name: &'static str,
+    /// Severity the tag reports at.
+    pub severity: Severity,
+    /// How sure checks are when emitting this tag.
+    pub certainty: Certainty,
+    /// Whether the tag is experimental (`X:` output, hidden by default).
+    pub experimental: bool,
+    /// One-paragraph explanation, shown by `--info` and `--list-tags`.
+    pub description: &'static str,
+    /// References (policy sections, URLs) shown by `--info`.
+    pub references: &'static [&'static str],
+}
+
+impl Tag {
+    /// The output letter for this tag: experimental tags render as `X:`
+    /// regardless of their severity, like lintian.
+    pub fn letter(&self) -> char {
+        if self.experimental {
+            'X'
+        } else {
+            self.severity.letter()
+        }
+    }
+}