chore: remove dead packages and make the CI fuzz gate real

- Delete internal/jsonc and internal/providers: zero production importers.
- Drop their references from the Makefile test-new/cover-new targets.
- Add a non-mutating fmt-check target and use it in make ci.
- Fix the fuzz job: each target now names a single package (./cmd/... had
  multiple, so the cmd target failed setup silently) and failures are no
  longer swallowed by || true.

Author: Patel230

.github/workflows/ci.yml

@@ -531,12 +531,15 @@ jobs:
           cache: true
       - name: Run fuzz targets
         run: |
-          go test -fuzz=FuzzScanForAIComments   -fuzztime=60s ./cmd/... || true
-          go test -fuzz=FuzzValidateSettings     -fuzztime=60s ./internal/config/... || true
-          go test -fuzz=FuzzIsSuspicious         -fuzztime=60s ./internal/tool/... || true
-          go test -fuzz=FuzzIsSafeGitCommit      -fuzztime=60s ./internal/tool/... || true
-          go test -fuzz=FuzzParseMessage         -fuzztime=60s ./internal/session/... || true
-          go test -fuzz=FuzzParseSessionMeta     -fuzztime=60s ./internal/session/... || true
+          # Each target must name a single package: `-fuzz` rejects `./x/...`
+          # when it expands to more than one package, which previously made the
+          # cmd target fail setup silently under `|| true`.
+          go test -run='^$' -fuzz=FuzzScanForAIComments -fuzztime=60s ./cmd
+          go test -run='^$' -fuzz=FuzzValidateSettings   -fuzztime=60s ./internal/config
+          go test -run='^$' -fuzz=FuzzIsSuspicious       -fuzztime=60s ./internal/tool
+          go test -run='^$' -fuzz=FuzzIsSafeGitCommit    -fuzztime=60s ./internal/tool
+          go test -run='^$' -fuzz=FuzzParseMessage       -fuzztime=60s ./internal/session
+          go test -run='^$' -fuzz=FuzzParseSessionMeta   -fuzztime=60s ./internal/session
 
   # -------------------------------------------------------------------------
   # 10. Smoke — build rho and verify ecosystem CLI wiring.

Makefile

@@ -73,7 +73,7 @@ test-10x: ## Run tests 10 times to surface flakes.
 	go test ./... -race -count=10 -timeout=600s
 
 test-new: ## Run only the Round 2 ecosystem packages (fast iteration).
-	go test -race -count=1 -timeout=60s ./internal/safewrite/... ./internal/jsonc/... ./internal/providers/... ./internal/session/... ./internal/permissions/...
+	go test -race -count=1 -timeout=60s ./internal/safewrite/... ./internal/session/... ./internal/permissions/...
 
 test-live: ## Run opt-in live integration tests (requires real LLM credentials).
 	@echo "Running live integration tests — requires OPENCODEGO_API_KEY"
@@ -86,7 +86,7 @@ cover: ## Generate a coverage report (coverage.out + coverage.html).
 	@echo "Coverage report: coverage.html"
 
 cover-new: ## Coverage report for Round 2 ecosystem packages only.
-	go test -cover -timeout=30s ./internal/safewrite/... ./internal/jsonc/... ./internal/providers/... ./internal/session/... ./internal/permissions/...
+	go test -cover -timeout=30s ./internal/safewrite/... ./internal/session/... ./internal/permissions/...
 
 api-docs: ## Generate HTML API reference from OpenAPI spec.
 	@command -v redoc-cli >/dev/null 2>&1 || (echo "install: npm install -g redoc-cli" && exit 1)
@@ -109,6 +109,12 @@ fmt: ## Format source files (gofumpt + goimports).
 	@git ls-files -- '*.go' | xargs $(GOFUMPT) -w
 	@git ls-files -- '*.go' | xargs $(GOIMPORTS) -w
 
+fmt-check: ## Verify formatting without rewriting files (CI-safe).
+	@command -v $(GOFUMPT)   >/dev/null 2>&1 || (echo "install: go install mvdan.cc/gofumpt@latest"   && exit 1)
+	@command -v $(GOIMPORTS) >/dev/null 2>&1 || (echo "install: go install golang.org/x/tools/cmd/goimports@latest" && exit 1)
+	@out=$$(git ls-files -- '*.go' | xargs $(GOFUMPT) -l); if [ -n "$$out" ]; then echo "gofumpt found unformatted files:"; echo "$$out"; exit 1; fi
+	@out=$$(git ls-files -- '*.go' | xargs $(GOIMPORTS) -l); if [ -n "$$out" ]; then echo "goimports found unformatted files:"; echo "$$out"; exit 1; fi
+
 vet: ## Run go vet.
 	go vet ./...
 
@@ -154,7 +160,7 @@ tidy: ## Sync workspace modules and verify checksums.
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: tidy fmt vet boundaries lint test-race security api-validate ## Run everything CI runs.
+ci: tidy fmt-check vet boundaries lint test-race security api-validate ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 smoke: ## Quick build + doctor + ecosystem verification.