feat(principles): principles.py turns the mechanical lenses into tool hits

principles.py runs ruff (C901, PLR0913, BLE001, S110, B006, B008, ARG), lizard (CCN, NLOC, parameters per function span) and jscpd (clones) on the lines a change touches and maps each hit to SRP, fail fast, KISS/YAGNI or DRY; a missing tool prints skip, every threshold is a required flag. It reuses the diff parsing of defaults.py, registered in sys.modules before it runs because dataclasses look the module up there, and hands lizard only the suffixes its 1.24.1 readers claim, since lizard parses any other file as C. kvb-code-clean step 3 calls it with McCabe's 10, pylint's 5 parameters, jscpd's 50 tokens and 50 NLOC; make install adds lizard 1.24.1 (pipx) and jscpd 5.4.2 (npm). The lizard and jscpd parsers are tested on fixture output only: neither tool has run for real yet.

🎯 Fix: 90 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: new
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 86
🚦 Gate: ⚠️ time new: ask the operator before the commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/install.sh

@@ -82,6 +82,26 @@ if [[ "${TARGET}" == "${HOME}" ]]; then
 	else
 		warn "skills: the MEDUSA install failed; kvb-check-security reviews by hand."
 	fi
+	lizard_pin="lizard==1.24.1"
+	if command -v lizard &>/dev/null; then
+		log "skills: lizard is installed"
+	elif ! command -v pipx &>/dev/null; then
+		warn "skills: pipx not found; install lizard with 'pipx install ${lizard_pin}'. Until then principles.py skips its complexity hits."
+	elif pipx install "${lizard_pin}"; then
+		log "skills: installed ${lizard_pin} for the principles.py complexity hits"
+	else
+		warn "skills: the lizard install failed; principles.py skips its complexity hits."
+	fi
+	jscpd_pin="jscpd@5.4.2"
+	if command -v jscpd &>/dev/null; then
+		log "skills: jscpd is installed"
+	elif ! command -v npm &>/dev/null; then
+		warn "skills: npm not found; install jscpd with 'npm install --global ${jscpd_pin}'. Until then principles.py skips its clone hits."
+	elif npm install --global "${jscpd_pin}"; then
+		log "skills: installed ${jscpd_pin} for the principles.py clone hits"
+	else
+		warn "skills: the jscpd install failed; principles.py skips its clone hits."
+	fi
 fi
 
 log "skills: done. Restart your agent to load the skills."