perf(config): replace chain := []string{} with var; add workspace test

Third code-review pass found three issues:

1. validate.go and kind_extends.go: `chain := []string{}` allocates an
   empty backing array on every call. `var chain []string` (nil slice)
   defers the first allocation to the initial append, saving one heap
   allocation on every call where the loop never appends (kinds without
   an extends: chain in validateKindExtends, or when the extends chain
   has no schemas in extendsChainSchemas).

2. provenance.go: `allRuleNames` was the last `map[string]bool` presence
   set in the file not converted by the previous commit. Changed to
   `map[string]struct{}` for consistency with the surrounding code.

3. workspace_test.go: Add TestMemFSDirEntriesIgnoresEmptySegment to
   document and pin the empty-name-segment guard in memFS.dirEntries.
   A key with a double-slash segment (e.g. "a//b.md") produces an empty
   first component after stripping the directory prefix; the nested-if
   guard introduced in 9b0fa79 must check `name != ""` before the
   seen-map probe. The test constructs memFS directly (bypassing
   NewMemWorkspace path.Clean) to exercise this path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjbjBieiWMBKURdKVNnPvy

Author: claude

internal/config/kind_extends.go

@@ -101,7 +101,7 @@ func extendsChainSchemas(
 	kinds map[string]KindBody, name string,
 ) ([]schemaChainEntry, error) {
 	visited := make(map[string]struct{})
-	chain := []string{}
+	var chain []string
 	current := name
 	for current != "" {
 		if _, ok := visited[current]; ok {

internal/config/provenance.go

@@ -354,10 +354,10 @@ func splitRulesByExplicit(cfg *Config) (defaults, user map[string]RuleCfg) {
 }
 
 func allRuleNames(layers []layerInfo) []string {
-	seen := map[string]bool{}
+	seen := make(map[string]struct{})
 	for _, l := range layers {
 		for name := range l.Rules {
-			seen[name] = true
+			seen[name] = struct{}{}
 		}
 	}
 	names := make([]string, 0, len(seen))

internal/config/validate.go

@@ -76,7 +76,7 @@ func ValidateKinds(cfg *Config) error {
 // deterministic across runs.
 func validateKindExtends(kinds map[string]KindBody, name string) error {
 	visited := make(map[string]struct{})
-	chain := []string{}
+	var chain []string
 	current := name
 	for current != "" {
 		if _, ok := visited[current]; ok {

pkg/mdsmith/workspace_test.go

@@ -266,6 +266,34 @@ func TestMemFSGlobDoublestar(t *testing.T) {
 	}
 }
 
+// TestMemFSDirEntriesIgnoresEmptySegment verifies that a key whose first
+// segment after the directory prefix is empty (produced by a double-slash
+// in the raw key, bypassing NewMemWorkspace cleanup) does not produce an
+// empty-name directory entry. The guard `if name != ""` in dirEntries must
+// be checked before the seen-map probe to prevent probing with key "".
+func TestMemFSDirEntriesIgnoresEmptySegment(t *testing.T) {
+	// Construct memFS directly to bypass NewMemWorkspace path.Clean so the
+	// double-slash key is preserved; "a//b.md" after stripping prefix "a/"
+	// leaves "/b.md", whose first segment is "".
+	m := memFS{
+		"a//b.md": []byte("b"),
+		"a/c.md":  []byte("c"),
+	}
+	ents := m.dirEntries("a")
+	for _, e := range ents {
+		if e.Name() == "" {
+			t.Fatalf("dirEntries emitted an entry with empty name: %#v", e)
+		}
+	}
+	if len(ents) != 1 || ents[0].Name() != "c.md" {
+		names := make([]string, len(ents))
+		for i, e := range ents {
+			names[i] = e.Name()
+		}
+		t.Fatalf("dirEntries(\"a\") with double-slash key = %v, want [c.md]", names)
+	}
+}
+
 // --- indexSlash ---
 
 // TestIndexSlash covers the four boundary cases: no slash, slash at