feat(checker): scaffold repo-root cargo workspace + cph-diag + cph-model (WU-1)

Stand up the Rust implementation of the rule-based checker (the thing that
"stands in Lean's position" at product runtime). Single repo-wide cargo
workspace at the repo root so future components (e.g. an exporter) can reuse
shared crates.

- workspace: 6 member crates under crates/; cph-schema/cph-typst/cph-check/
  cph-cli are stubs for later WUs that compile clean today.
- cph-diag: shared diagnostic vocabulary. Severity { Warning, Error } mirrors
  Spec.Courseware.Diagnostic.Severity exactly (two-valued, no info/note — a
  contract decision documented in-code since there's no CI gate for alignment).
  Closed DiagCode set with stable string forms; Diagnostic with optional span +
  fix hint; Display renders `error[CODE]: msg / --> file:line:col / hint: …`.
- cph-model: the ADR-0008 loader. Reads manifest.toml ([project]/[info]/ordered
  [[parts]]/[targets.*]) + each part's element.toml into an ordered Lesson
  (mirrors Lean `Lesson = List (Element P)`). Structure-only: cross-checks
  part.kind == element.toml kind, rejects `..` traversal; does NOT do schema
  validation (WU-3), content-file existence (WU-3), or typst (WU-4).
  `load(root) -> (Option<Lesson>, Vec<Diagnostic>)`: Some even on collectible
  part errors, None only on hard manifest failure.
- 13 tests (7 cph-diag, 6 cph-model incl. static fixtures doubling as format
  docs). build + test + clippy -D warnings + fmt --check all green.

Judgment call flagged for review: cph-diag has no ManifestMalformed code, so
manifest-structure errors map to SchemaViolation (TODO noted in-code).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/cph-model/tests/load.rs

@@ -0,0 +1,125 @@
+//! Integration tests for `cph_model::load`, driven by static fixtures under
+//! `tests/fixtures/`. The fixtures double as documentation of the ADR-0008
+//! on-disk format.
+
+use std::path::PathBuf;
+
+use cph_diag::DiagCode;
+use cph_model::load;
+
+/// Absolute path to a fixture engineering-file root.
+fn fixture(name: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures")
+        .join(name)
+}
+
+#[test]
+fn valid_two_part_lesson_loads_in_order_with_no_errors() {
+    let (lesson, diags) = load(&fixture("valid"));
+
+    let lesson = lesson.expect("valid fixture must produce a Lesson");
+    assert!(
+        diags.is_empty(),
+        "valid fixture must have no diagnostics, got: {diags:?}"
+    );
+
+    assert_eq!(lesson.project.id, "fixture-valid");
+    assert_eq!(lesson.project.name, "valid-2-part");
+    assert_eq!(lesson.info.title, "测试课：两个部件");
+    assert_eq!(lesson.info.author.as_deref(), Some("范式教育教研组"));
+
+    // Parts preserve declared order: segment first, lemma second.
+    assert_eq!(lesson.parts.len(), 2);
+    assert_eq!(lesson.parts[0].kind, "segment");
+    assert_eq!(lesson.parts[0].path, PathBuf::from("segments/intro"));
+    assert_eq!(lesson.parts[0].descriptor.kind, "segment");
+    assert_eq!(lesson.parts[1].kind, "lemma");
+    assert_eq!(lesson.parts[1].path, PathBuf::from("lemmas/young"));
+    assert_eq!(lesson.parts[1].descriptor.kind, "lemma");
+
+    // `source` scalar survives on the lemma descriptor; `kind` is removed.
+    let scalars = &lesson.parts[1].descriptor.scalars;
+    assert_eq!(
+        scalars.get("source").and_then(|v| v.as_str()),
+        Some("测试引理")
+    );
+    assert!(scalars.get("kind").is_none());
+
+    // Targets are collected from [targets.*].
+    let mut targets = lesson.targets.clone();
+    targets.sort();
+    assert_eq!(targets, vec!["student".to_string(), "teacher".to_string()]);
+
+    // Descriptor dir is absolute, anchored under the root.
+    assert!(lesson.parts[0].descriptor.dir.is_absolute());
+    assert_eq!(
+        lesson.parts[0].descriptor.dir,
+        lesson.root.join("segments/intro")
+    );
+}
+
+#[test]
+fn missing_part_folder_yields_part_path_missing() {
+    let (lesson, diags) = load(&fixture("missing-part"));
+
+    // Still produces a Lesson (loader stays best-effort).
+    let lesson = lesson.expect("missing-part fixture must still produce a Lesson");
+    assert_eq!(lesson.parts.len(), 2, "both parts are recorded for order");
+
+    let missing: Vec<_> = diags
+        .iter()
+        .filter(|d| d.code == DiagCode::PartPathMissing)
+        .collect();
+    assert_eq!(
+        missing.len(),
+        1,
+        "exactly one PartPathMissing expected, got diags: {diags:?}"
+    );
+    assert_eq!(missing[0].severity, cph_diag::Severity::Error);
+}
+
+#[test]
+fn kind_mismatch_yields_unknown_kind_diagnostic() {
+    let (lesson, diags) = load(&fixture("kind-mismatch"));
+
+    let lesson = lesson.expect("kind-mismatch fixture must still produce a Lesson");
+    assert_eq!(lesson.parts.len(), 1);
+
+    let mismatch: Vec<_> = diags
+        .iter()
+        .filter(|d| d.code == DiagCode::UnknownKind)
+        .collect();
+    assert_eq!(
+        mismatch.len(),
+        1,
+        "exactly one kind-mismatch diagnostic expected, got: {diags:?}"
+    );
+    assert!(
+        mismatch[0].message.contains("segment") && mismatch[0].message.contains("lemma"),
+        "message should name both kinds, got: {}",
+        mismatch[0].message
+    );
+}
+
+#[test]
+fn malformed_manifest_is_a_hard_failure() {
+    let (lesson, diags) = load(&fixture("malformed-manifest"));
+
+    assert!(
+        lesson.is_none(),
+        "malformed manifest must be a hard failure (None)"
+    );
+    assert_eq!(diags.len(), 1, "one hard-failure diagnostic expected");
+    assert_eq!(diags[0].code, DiagCode::SchemaViolation);
+    assert_eq!(diags[0].severity, cph_diag::Severity::Error);
+}
+
+#[test]
+fn missing_manifest_is_a_hard_failure() {
+    // A directory with no manifest.toml at all.
+    let (lesson, diags) = load(&fixture("does-not-exist-at-all"));
+    assert!(lesson.is_none());
+    assert_eq!(diags.len(), 1);
+    assert_eq!(diags[0].code, DiagCode::SchemaViolation);
+}