Retire the superseded evaluator, and stop the install scripts failing on a shared API quota

[awsmadi]

Base: main. Independent of #717 — nothing here touches evaluator semantics.

Three unrelated-looking pieces that share one theme: things CI was not actually checking. A dead
evaluator nobody had removed, an installer whose failures could not surface, and a PowerShell
script with no static analysis at all.

9 commits, 35 files, +632 / −6,036.

What prompted it

The Windows install job failed on an unrelated pull request:

{"message": "API rate limit exceeded for 20.9.183.48."}

20.9.183.48 is a shared GitHub Actions runner. The anonymous GitHub API allows 60 requests an
hour per source IP, counted across everyone behind it, and install-guard.ps1 resolved the
latest release through it unauthenticated. The same ceiling reaches real users: a corporate NAT, a
VPN, or a colleague installing from the same office is enough.

Pulling that thread turned up two further problems, both of which had been invisible precisely
because nothing was looking.

The commits

Retiring the superseded evaluator

1. 6dc98ba Retire the superseded evaluator and its query engine — deletes evaluate.rs,
evaluate_tests.rs, the old path_value query engine and its tests, and aws_meta_appender.
−4,693 lines. This code was replaced by the eval module and had no remaining callers.

2. 144baac Make verbose output independent of the compiler that built it — verbose output
varied with build configuration, so what an operator saw depended on how the binary was compiled
rather than on the rules being evaluated.

3. e3fea72 Apply rustfmt — formatting only, from the deletions above.

4. 4cab372 Remove the dead Reporter::report method — the trait method had no live
implementations left once the old evaluator was gone. −349 lines across nine reporters.

5. 448317b Delete the two unreachable validate reporters — cfn_reporter and
console_reporter were no longer reachable from any command path. −472 lines.

6. 2e0fc4c Delete the rest of the legacy reporting cluster; zero dead-code warnings — the
remaining fragments, taking the crate from 43 dead-code warnings to none.

Making the test suite able to fail

7. 3445508 Anchor test path sanitisation on the crate dir, not $HOME — the integration
harness rewrote absolute paths by substituting $HOME, which only works when the checkout lives
under the home directory. Anywhere else the substitution missed and 15 expected-output tests failed
on path noise alone. Anchored on CARGO_MANIFEST_DIR instead.

The installers

8. 0df9eae Stop the install scripts failing on an anonymous GitHub API quota — the substance
of the fix, covering several distinct problems:

• Resolution order. gh CLI first when installed and authenticated, since it reuses
  credentials the caller already has; then the REST API with GITHUB_TOKEN if the environment
  supplies one; then anonymously, the only path the limit applies to. An explicit version skips the
  lookup entirely, and install-guard.ps1 gains -Version for that, matching -v in
  install-guard.sh.
• Backoff from the API's own signals, not guesses: retry-after on a secondary limit,
  x-ratelimit-reset when the primary one is exhausted, exponential backoff only when neither
  header is readable. Blind doubling would retry straight into an empty quota and report a network
  error for what is really a quota problem.
• A five-minute ceiling on waiting. A primary reset can be an hour away, and an installer that
  appears hung for an hour is worse than one that explains itself. Past the cap it stops and names
  GITHUB_TOKEN, gh auth login and -Version as the ways out.
• install-guard.sh could not fail. err() exits, but it was reached from the left side of a
  pipeline feeding a while read loop, so exit 1 ended only that subshell and the pipeline took
  its status from the loop, which had read nothing. A failed lookup left the script exiting 0
  with nothing installed. That is why only the Windows job went red: all three platforms hit the
  same wall and only the one without this bug reported it. get_version's result is assigned now.
• Get-WmiObject was removed in PowerShell 6, and this workflow runs pwsh 7. Architecture
  detection reads OSArchitecture from RuntimeInformation instead — part of the framework,
  present in every supported host, and exercisable off Windows, which the WMI and CIM cmdlets are
  not.
• The token is passed to curl through a config file on stdin, not argv. An Authorization
  header on a command line is readable from ps by anyone else on the host for the life of the
  request. It is only ever sent to api.github.com; the release archive redirects to a separate
  download host.
• The install jobs now build from the branch under test, package the binary into the release
  layout, install that, and assert the installed binary's checksum matches the one just built.
  They previously resolved the latest release and installed it, so they tested the installer
  against a binary unrelated to the change under review, over the API that failed above.

Static analysis for the PowerShell script

9. 583c3b8 Gate install-guard.ps1 on PSScriptAnalyzer — install-guard.sh has been guarded
by shellcheck since it was written; the PowerShell script had nothing. That is how the
Get-WmiObject call survived: the script referenced a cmdlet its own CI shell does not have, and
nothing in the repository was looking.

Configured by .github/PSScriptAnalyzerSettings.psd1 at Error, Warning and Information, so a new
finding fails the build. PSAvoidUsingWriteHost is the single exclusion, with the reasoning
recorded beside it: Get-ArchType and Get-GuardVersion return their values through the
pipeline, so routing progress commentary to Write-Output as the rule advises would mix that text
into their return values and break them.

Run against the script as it stood before commit 8, the analyser reports two real problems; run
against it now, none. The gate starts clean rather than with a backlog to grandfather in.

Verification

Check	Result
cargo fmt --check	pass
cargo clippy -- -D warnings	pass
cargo clippy --all-targets -- -D warnings	pass
typos	pass
shellcheck install-guard.sh	pass
PSScriptAnalyzer	0 findings
Test suite	620 passed, 0 failed; validate 96/0
Install job, run end to end locally	installed binary's SHA256 equals the branch build

Two failure paths were exercised rather than assumed: a missing archive exits 1, and an unreachable
API exits 1 after retrying with the guidance above. Both exited 0 before.

The PowerShell logic that cannot run on a Linux runner was unit-tested separately — architecture
mapping, -Version bypassing the API, retry-after precedence, reset-based waiting, header
fallback, and the gh path — 9 checks, all passing.

Merge order against #717

These two touch 17 files in common and both are individually mergeable, so whichever lands second
will need a rebase. One file is worth knowing about before that happens:
guard/src/commands/reporters/validate/cfn_reporter.rs, which this PR deletes as unreachable and
#717 modifies.

The resolution is to take the deletion. #717's change to that file is a mechanical signature update,
HashSet<String> to SkippedRules, made so the file kept compiling when that type changed, plus a
comment noting that this path carries no record tree and so reports skips without reasons. It is not
a fix, and it has no effect on behaviour, because neither CfnReporter nor SingleLineReporter is
ever constructed. Every other overlapping file is modified by both and conflicts only where the two
edits sit near each other.

Measured with git merge-tree rather than inferred from GitHub's mergeable flag, which reports on
each PR against main separately and so says nothing about this.