test(intent): port the integration suite that stayed behind in dotfiles

The checker was lifted into this crate but its integration suite was not: 19 tests
in `flakes/axe/tests/vrs_check.rs` stayed in `schickling/dotfiles` and drive the
`axe` binary. They are the differential oracle for the extraction, so a tool whose
real test suite lives in its own consumer is backwards — and invisible until the day
that consumer stops depending on it. `cargo test` here reported 8 passing unit tests,
which is a much weaker suite than the "19/19" figure the extraction has been quoted
as having.

Ported: the harness now drives `CARGO_BIN_EXE_intent` with top-level subcommands
instead of the `axe vrs …` layer. The corpus-relative asset resolution the lift
introduced needed checking rather than assuming, and it holds: the helpers pass
`repo/context/vrs` — a corpus root, not a repository root — and the harness builds
`16-enforcement/` underneath it, which is exactly what resolution now requires.

10 of the 19 travelled. The other 9 did not, and the file names each one and why.
They exercise `review` / `review-fixtures` through the CAIC runner, a separate
binary owned by `axe`, and they assert on the CAIC envelope itself
(`coding_agent.result.v1`, `run.context_files`, `run.permission.effective`). This
crate builds no such binary, and lifting `caic` here would invert the settled
dependency — `axe` consumes `intent`, not the reverse. A stub could only make them
pass by reimplementing the collaborator under test, which is the "green because the
hard cases were dropped" failure in a more expensive disguise.

Those 9 stay green in `axe`'s own suite, so the behaviour is still covered — but only
while `axe` keeps consuming this crate. Closing the gap needs a CAIC boundary this
crate can drive on its own, and that is not this commit.

The two `review_*` tests that did travel are the ones that refuse before CAIC is ever
executed, so no runner is needed to reach their assertions. `--coding-agent` is handed
a deliberately non-existent path to keep that property honest: if a test ever needs it
to run, that test does not belong in this file.

Verified: 8 unit + 10 integration pass natively and inside `nix flake check`, where
the sandbox runs the exec'd fake providers without complaint; fmt and
`clippy -D warnings` clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
agent-tool: Claude Code
agent-tool-version: 2.1.220
agent-runtime: Claude Code 2.1.220
agent-session-lookup: unavailable
tooling-profile: dotfiles@unknown-dirty

Author: schickling-assistant