Python CLI control plane: replace bash logic with a single-file CLI

[romeobravo]

What

Replaces the bash logic (dispatcher, setup, uninstaller, adapters) with a single-file Python CLI (peon-poke, python3.8+, stdlib only) and keeps every existing entry-point name as a zero-logic sh shim. Plan: PLAN-python-cli.md.

agent hook / plugin / user
        ▼
peon-poke  (dispatch | play | codex | gemini | cursor | grok | setup | uninstall | doctor)
        ▼
bin/poke   (C, unchanged)  →  MultitouchSupport.framework

Changes

• peon-poke (new): dispatch/play (config-gated, detached+quiet, always exit 0), agent event adapters, setup, uninstall, doctor
• Shims: poke.sh, peon-poke-setup, uninstall.sh (5 lines), adapters/{gemini,cursor,grok}.sh (2 lines) — kept for the brew formula, user-owned manual wiring, and mid-upgrade legacy hooks (retirement path documented)
• adapters/codex.sh deleted: Codex notify now points directly at the CLI — notify = [".../bin/peon-poke", "codex"]
• Claude hooks registered as shlex.join-ed CLI commands (space/quote safe); legacy bash .../poke.sh shapes still recognized as ours — setup heals them, uninstall removes both shapes
• PATH commands: peon-poke + peon-poke-uninstall symlinks both point at the one CLI file (uninstall chosen by argv[0], no launcher script)
• Plugins (pi, OpenCode) spawn bin/peon-poke directly — no bash in the hot path
• Safety preserved: ownership markers, safe_rm refuse-list, exact-shape hook/TOML ownership, stable .peon-poke-bak backups, atomic writes everywhere (setup's Claude write is now atomic too)
• Payload coupling in one commit: install-remote.sh allowlist + scripts/sha256sums.sh + regenerated SHA256SUMS include peon-poke; CI py_compiles the CLI

Tests

Full suite green (144 assertions): adapter matrix via CLI subcommands (incl. JSON argv / stdin / legacy names / unknown-silence), TOML setup fixtures (empty / table-ending / user-notify / malformed / quoted-paths / idempotency / new: legacy-shape migration), uninstall destructive-safety guards (new: both notify shapes, legacy Claude hook removal), ownership/symlink hardening, installer manifest traversal guards, plugin harnesses. Verified end-to-end: file:// remote install → setup → dispatch, plus a real haptic boop.

Release notes

• Tap formula must add peon-poke to libexec.install (and chmod 0755) in the same session the next tag is cut — before that tag, the old formula + old tag keep working; after, the new formula is required. Documented in AGENTS.md.
• Users' manual Gemini/Grok/Cursor wiring keeps working unchanged (shims).
• Old Claude/Codex registrations are healed to the new shapes on first peon-poke setup run.