feat(run): resume-aware per-check runs, verify hooks, run-state hardening

/pygienium-<check> is now resume-aware (terminal checks skipped unless
--fresh) and shares run-state with all/resume; every check gets a verify
hook that fails loudly when a sub-agent returns ok with no artifact;
run-state clears stale errors on retry success and reconciles a run as
failed only when every check failed. Drops the superseded
hygiene-state.ts model.

src/checks/deep-modules.ts

@@ -69,6 +69,33 @@ function deepModulesGate(cwd: string): string | undefined {
 	return undefined;
 }
 
+/**
+ * Verify hook: confirms the check actually produced its artifacts (mirrors
+ * {@link commentsVerify} / {@link todosVerify}). After scan `findings.md` must
+ * exist; after `--fix` `changes.md` must exist too. Catches a sub-agent that
+ * returns ok with no output — which would otherwise be a false `complete`.
+ */
+async function deepModulesVerify(
+	scope: CheckScope,
+): Promise<string | undefined> {
+	const { stat } = await import("node:fs/promises");
+	const f = findingsPath(scope.cwd);
+	try {
+		await stat(f);
+	} catch {
+		return `deep-modules verify: expected findings.md at ${f} after scan, none found.`;
+	}
+	if (scope.fix) {
+		const c = changesPath(scope.cwd);
+		try {
+			await stat(c);
+		} catch {
+			return `deep-modules verify: expected changes.md at ${c} after --fix, none found.`;
+		}
+	}
+	return undefined;
+}
+
 /**
  * Build the scan task. The deep-modules scanner agent inspects the target,
  * classifies modules by abstraction depth against the rubric, and writes a
@@ -155,6 +182,7 @@ const deepModulesCheck: CheckDefinition = {
 	buildScanTask: buildDeepScanTask,
 	buildFixTask: buildDeepFixTask,
 	gate: deepModulesGate,
+	verify: deepModulesVerify,
 };
 
 registerCheck(deepModulesCheck);