feat(run): resume-aware per-check runs, verify hooks, run-state hardening

/pygienium-<check> is now resume-aware (terminal checks skipped unless
--fresh) and shares run-state with all/resume; every check gets a verify
hook that fails loudly when a sub-agent returns ok with no artifact;
run-state clears stale errors on retry success and reconciles a run as
failed only when every check failed. Drops the superseded
hygiene-state.ts model.

src/checks/complexity.ts

@@ -270,6 +270,34 @@ async function complexityGate(cwd: string): Promise<string | undefined> {
 	}
 }
 
+/**
+ * Verify hook: confirms the check actually produced its artifacts. After the
+ * scan phase `findings.md` must exist; after the fix phase `changes.md` must
+ * exist too. Without this, a sub-agent that returns empty/ok without writing
+ * its report would be stamped `complete` — a false positive. Mirrors
+ * {@link commentsVerify} / {@link todosVerify}.
+ */
+async function complexityVerify(
+	scope: CheckScope,
+): Promise<string | undefined> {
+	const { stat } = await import("node:fs/promises");
+	const f = findingsPath(scope);
+	try {
+		await stat(f);
+	} catch {
+		return `complexity verify: expected findings.md at ${f} after scan, none found.`;
+	}
+	if (scope.fix) {
+		const c = changesPath(scope);
+		try {
+			await stat(c);
+		} catch {
+			return `complexity verify: expected changes.md at ${c} after --fix, none found.`;
+		}
+	}
+	return undefined;
+}
+
 /** The excessive complexity check definition. */
 export const complexityCheck = {
 	name: "complexity",
@@ -282,6 +310,7 @@ export const complexityCheck = {
 	buildScanTask: buildComplexityScanTask,
 	buildFixTask: buildComplexityFixTask,
 	gate: complexityGate,
+	verify: complexityVerify,
 } as const;
 
 // Self-register on import so index.ts auto-discovery picks it up.