[bug] tri t27o-sweep cannot sweep another repository: seals and git ls-files are read from the current directory #10638

Summary

tri t27o-sweep (#10543, PR #10587) can only sweep the repository it is run in: it reads .trinity/seals/t27o_T27oRust.json and t27o_T27oRustStd.json and runs git ls-files relative to the current directory. From a checkout of trios, trinity, trinity-fpga or 999-multibots-telegraf it stops with a bare Error: No such file or directory (os error 2) -- the path is not named, because the read of the seal has no context (observed 2026-10-19 with a tri built from master + #10611 + #10631, run in /Users/playom/trios as tri t27o-sweep crates) -- so the roadmap dogfood of #10522 still needs a shell loop for four of the five repositories.

Expected vs actual

Expected: tri t27o-sweep --repo /path/to/trios crates lists and reads files in that checkout, takes the two seal keys from the t27 checkout the binary belongs to, and keeps one cache per swept repository. Actual: the seals and the listing are both taken from the current directory, and the error names no file. A missing seal should say which path it looked for.

Steps to reproduce

cd /path/to/trios && /path/to/t27/target/release/tri t27o-sweep crates

Boundary

• May touch: specs/tools/t27o/ledger.t27 (the cache path per repository, if it is a rule), its gen file and seal, cli/tri/src/main.rs (T27oSweep, cmd_t27o_sweep; every added hand line paid for by a deleted one, the required own-language check).
• Must not touch: rust_convert.t27.

Risks / severity

Low: a measurement convenience. Without it the cross-repository numbers keep coming from a per-file loop, which is slower and has no reuse.

Links

#10522, #10543, #10587.

User Scenarios

• Given a tri binary built from the t27 repository, when the user runs tri t27o-sweep --repo /path/to/trios crates from any directory, then the command reads the two seal files (.trinity/seals/t27o_T27oRust.json and t27o_T27oRustStd.json) from the t27 checkout that the binary belongs to, runs git ls-files in /path/to/trios, and writes the sweep cache under a per-repository path derived from /path/to/trios.

• Given a missing seal file in the t27 checkout, when the user runs tri t27o-sweep --repo /path/to/trios crates, then the command fails with an error message that names the exact seal path it attempted to read (e.g., /path/to/t27/.trinity/seals/t27o_T27oRust.json).

Requirements

• FR-001: The t27o-sweep subcommand MUST accept a --repo <PATH> option that specifies the target repository to sweep.
• FR-002: The seal files (t27o_T27oRust.json and t27o_T27oRustStd.json) MUST be read from the t27 checkout containing the tri binary, not from the current working directory.
• FR-003: The git ls-files invocation MUST be executed with its working directory set to the --repo path.
• FR-004: The sweep cache path MUST be unique per target repository (e.g., derived from the absolute path of --repo).
• FR-005: When a seal file is not found, the error message MUST include the absolute path that was attempted.
• FR-006: Every added hand-written line in cli/tri/src/main.rs MUST be paid for by a deleted line (the required own-language check).

Success Criteria

• tri t27o-sweep --repo /path/to/trios crates exits with exit 0 and produces a cache file under the per-repository cache directory for /path/to/trios.
• Running the same command a second time reuses the cache (no re-scan) — verified by checking the cache file's mtime is unchanged.
• tri t27o-sweep --repo /path/to/nonexistent crates fails with an error naming the missing seal path (e.g., "No such file or directory: /path/to/t27/.trinity/seals/t27o_T27oRust.json").
• The seal-reading logic uses the binary's own location (via std::env::current_exe) to find the t27 checkout — verified by running the binary from a different directory and confirming it still finds the seals in the t27 repo.
• 5 tests in cli/tri/src/sweep.rs pass (or are added and pass) covering: --repo flag parsing, seal resolution from binary location, git ls-files in target repo, per-repo cache isolation, and missing-seal error path reporting.