feat(sweep-tracker): hierarchical estate-sweep Markdown report

Adds `panic-attack sweep-tracker` subcommand that renders an issue-#32
shaped sweep tracker by joining per-finding hexads (issue #33 S1) with
campaign-state hexads (issue #33 S2). Distinct from `campaign status`:
that is a flat per-finding table; this is a hierarchical checklist
grouped by repo and/or category, with an estate-wide summary header.

Flags:
- `--verisimdb-dir DIR`  : hexad store root (default `verisimdb-data`)
- `--output FILE`        : write Markdown to file instead of stdout
- `--by-repo`            : emit only the "By repo" section
- `--by-category`        : emit only the "By category" section
- no flag                : emit both sections (default)

Output is deterministic — repos alphabetically, findings within each
repo sorted by (rule_id, file, line). A finding with no campaign
hexad shows state `open`; with one, shows the latest state plus PR
URL (rendered as `#<num>` link) or dismissal reason.

Tests cover empty store, by-repo grouping, by-category grouping,
campaign-state join (open / pr-merged / dismissed), deterministic
ordering, both-shape ordering, and PR-number label extraction.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/lib.rs

@@ -35,4 +35,5 @@ pub mod panll;
 pub mod report;
 pub mod signatures;
 pub mod storage;
+pub mod sweep_tracker;
 pub mod types;

src/main.rs

@@ -30,6 +30,7 @@ mod panll;
 mod report;
 mod signatures;
 mod storage;
+mod sweep_tracker;
 mod types;
 
 extern crate walkdir;
@@ -753,6 +754,30 @@ enum Commands {
         #[command(subcommand)]
         action: CampaignAction,
     },
+
+    /// Sweep-tracker: render an issue-#32-style estate-sweep Markdown report.
+    ///
+    /// Joins per-finding hexads (issue #33 S1) with campaign-state hexads
+    /// (issue #33 S2) and groups them by repo and/or category. Distinct
+    /// from `campaign status`: that is a flat per-finding table; this is
+    /// a hierarchical sweep checklist.
+    SweepTracker {
+        /// VeriSimDB data directory (default: `verisimdb-data`).
+        #[arg(long, value_name = "DIR", default_value = "verisimdb-data")]
+        verisimdb_dir: PathBuf,
+
+        /// Write the Markdown to a file instead of stdout.
+        #[arg(short, long, value_name = "FILE")]
+        output: Option<PathBuf>,
+
+        /// Emit only the "By repo" section.
+        #[arg(long, group = "sweep_shape", default_value_t = false)]
+        by_repo: bool,
+
+        /// Emit only the "By category" section.
+        #[arg(long, group = "sweep_shape", default_value_t = false)]
+        by_category: bool,
+    },
 }
 
 #[derive(Subcommand)]
@@ -2451,6 +2476,28 @@ fn run_main() -> Result<()> {
             return Ok(());
         }
 
+        Commands::SweepTracker {
+            verisimdb_dir,
+            output,
+            by_repo,
+            by_category,
+        } => {
+            let shape = match (by_repo, by_category) {
+                (true, false) => sweep_tracker::ReportShape::ByRepo,
+                (false, true) => sweep_tracker::ReportShape::ByCategory,
+                _ => sweep_tracker::ReportShape::Both,
+            };
+            let md = sweep_tracker::render_report(&verisimdb_dir, shape)?;
+            match output {
+                Some(path) => {
+                    std::fs::write(&path, &md)?;
+                    qprintln!(cli.quiet, "Sweep tracker written to {}", path.display());
+                }
+                None => print!("{}", md),
+            }
+            return Ok(());
+        }
+
         Commands::Temporal { action } => {
             match action {
                 TemporalAction::List { verisimdb_dir } => {