feat(P01): nova subcommands — thin delegates to core/* (CAP-033/034, cli-engineer)

One nova/<name>.py per user-facing core/ module. Each ≤50 lines, ≤3
FunctionDef (add_parser + run [+1 helper]), every user-function call
resolves to a core.* import, no `if` statements except `if __name__`.

Subcommands:
- nova resolve       → core.contract_resolver.resolve
- nova decommission  → core.decommission_transform.decommission_transform
- nova env-transition detect|record → core.env_transition
- nova env-check     → core.environment_check.check
- nova hitl          → core.hitl_gates.attest (+ approver_from_env)
- nova onboard       → core.onboarding.generate_env_file
- nova outbox        → core.outbox_writer.write_event
- nova publish-outputs → core.output_publisher.publish_to_ssm + format_comment
- nova policy        → core.policy_engine.get_engine + get_policy_root (status)
- nova regression    → core.regression_verify.run_regression + write_report
- nova sod           → core.separation_of_duties.check
- nova readiness     → core.submission_readiness.cli_main
- nova attestation-matrix → core.attestation_matrix.cli_main (new thin wrapper)
- nova confidence    → core.confidence_signal.cli_main (new thin wrapper)

core wrappers added (minimal): attestation_matrix.cli_main,
confidence_signal.cli_main — extracted from their __main__ blocks so
the nova subcommands stay thin.

---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: cli-engineer
---/ci---

core/attestation_matrix.py

@@ -169,20 +169,21 @@ def check(env: str, evidence: dict) -> Tuple[bool, str]:
     return (True, f"{env}: all {len(concerns)} concern(s) pass")
 
 
-if __name__ == "__main__":
+def cli_main(argv) -> int:
+    """Thin CLI entry (P1): nova attestation-matrix <env> [evidence.json]."""
     import json
-    if len(sys.argv) < 2:
-        print("usage: attestation_matrix.py <env> [evidence.json]", file=sys.stderr)
-        sys.exit(2)
-    _env = sys.argv[1]
+    if len(argv) < 2:
+        print("usage: attestation_matrix <env> [evidence.json]", file=sys.stderr)
+        return 2
+    _env = argv[1]
     _evidence = {}
-    if len(sys.argv) >= 3 and os.path.isfile(sys.argv[2]):
-        with open(sys.argv[2]) as f:
+    if len(argv) >= 3 and os.path.isfile(argv[2]):
+        with open(argv[2]) as f:
             _evidence = json.load(f)
     ok, reason = check(_env, _evidence)
-    if ok:
-        print(f"ATTESTATION PASS: {reason}")
-        sys.exit(0)
-    else:
-        print(f"ATTESTATION BLOCK: {reason}", file=sys.stderr)
-        sys.exit(1)
+    print(f"ATTESTATION PASS: {reason}") if ok else print(f"ATTESTATION BLOCK: {reason}", file=sys.stderr)
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(cli_main(sys.argv))

core/confidence_signal.py

@@ -218,12 +218,18 @@ def compute(contract_id: str, environment: str,
     return signal
 
 
-if __name__ == "__main__":
-    if len(sys.argv) < 3:
-        print("usage: confidence_signal.py <inputs.json> <environment>", file=sys.stderr)
-        sys.exit(2)
-    env = sys.argv[2]
-    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+def cli_main(argv) -> int:
+    """Thin CLI entry (P1): nova confidence <inputs.json> <environment>."""
+    if len(argv) < 3:
+        print("usage: confidence <inputs.json> <environment>", file=sys.stderr)
+        return 2
+    env = argv[2]
+    with open(argv[1], "r", encoding="utf-8") as fh:
         inputs = json.load(fh)
     sig = compute("cli", env, inputs)
-    print(json.dumps(asdict(sig), indent=2))
+    print(json.dumps(asdict(sig), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(cli_main(sys.argv))