test(01-04): cover tool, output, watch loop and workspace modules

- Non-TTY widgets/prompts, flag parsing, secret non-leak and malicious IDs
- Real hello workspace rebuild latency line, debounce and ignored bin/tmp
- scripts/check-phase1.sh runs vet/test/race across root, hello, base, greeter, optional

scripts/check-phase1.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Repeatable Phase 1 verification: vet, test, and race across every workspace module,
+# plus a built-binary integration check of examples/hello.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+run_module() {
+	local name="$1"
+	local dir="$2"
+	echo "==> ${name} (${dir})"
+	(
+		cd "$dir"
+		go vet ./...
+		go test ./...
+		go test -race ./...
+	)
+}
+
+run_module "root" "."
+run_module "hello app" "examples/hello"
+run_module "base plugin" "examples/hello/plugins/base"
+run_module "greeter plugin" "examples/hello/plugins/greeter"
+run_module "optional plugin" "examples/hello/plugins/optional"
+
+echo "==> built-binary integration (examples/hello)"
+(
+	cd examples/hello
+	go run ../../cmd/summer build
+	./bin/hello greeter:hello
+)
+
+echo "phase1 check passed"