dev: Use just as command runner instead of make (#182)

I've also broken down the monolithic Makefile (now a justfile) into
smaller scripts to keep things manageable.
Cargo tool installations now go through binstall, as we do in CI.

Author: LukeMathWalker

.githooks/pre-commit

@@ -10,11 +10,11 @@ if command -v dprint >/dev/null 2>&1; then
         exit 1
     fi
 else
-    echo "warning: dprint not found — format check skipped (run 'make install-tools' to install)" >&2
+    echo "warning: dprint not found — format check skipped (run 'just install-tools' to install)" >&2
 fi
 
 if ! command -v trufflehog >/dev/null 2>&1; then
-    echo "warning: trufflehog not found — secret scan skipped (run 'make install-tools' to install)" >&2
+    echo "warning: trufflehog not found — secret scan skipped (run 'just install-tools' to install)" >&2
     exit 0
 fi
 

.github/Pull_request_template

@@ -29,7 +29,7 @@
 -->
 
 ```bash
-make check          # fmt + toml-fmt + lint + test + build + audit + deny (CI parity)
+just check          # fmt + toml-fmt + lint + test + build + audit + deny (CI parity)
 
 # Single crate (if applicable):
 cargo test -p <crate-name>
@@ -81,7 +81,7 @@ cargo test -p <crate-name> <module>::tests::<test_name>
 ## Checklist
 
 - [ ] Thinking path traces from project context down to this specific change
-- [ ] `make check` passes locally (fmt + toml-fmt + lint + test + build + audit + deny)
+- [ ] `just check` passes locally (fmt + toml-fmt + lint + test + build + audit + deny)
 - [ ] No `.unwrap()`, `.expect()`, `panic!()`, or `unsafe` introduced outside of test code
 - [ ] All error paths are fail-closed — errors produce DENY, not silent ALLOW
 - [ ] No network calls added on the hot path (normalizer → Stage 1 → Stage 2)

.github/workflows/demo-e2e.yml

@@ -13,7 +13,7 @@ env:
 
 jobs:
   demo-ci:
-    name: make demo-ci
+    name: just demo-ci
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
@@ -37,11 +37,23 @@ jobs:
       - name: Install jq + netcat
         run: sudo apt-get install -y jq netcat-openbsd
 
+      - name: Install cargo-binstall
+        uses: cargo-bins/cargo-binstall@30b5ca8b54e1dcffd9548bc87ede1531310fdc67 # v1.20.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install just
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          command -v just || cargo binstall -y --force --locked just
+        shell: bash
+
       - name: Build release binaries
         run: cargo build --release -p firma -p firma-demo-fixture
 
       - name: Run demo CI driver
-        run: timeout 90 make demo-ci
+        run: timeout 90 just demo-ci
 
       - name: Assert audit ALLOW + DENY events
         run: |

.skills/build/SKILL.md

@@ -16,7 +16,7 @@ Run this skill after making code changes to ensure the workspace still compiles.
 ### Full workspace build
 
 ```bash
-make build
+just build
 ```
 
 ### Single-crate build
@@ -43,5 +43,5 @@ cargo build -p firma-run --all-features
 
 ## Notes
 
-- `make check` already includes `make build`, so a full PR validation does not need a separate build step.
-- Prefer `make build` over ad hoc cargo invocations unless you are intentionally narrowing scope.
+- `just check` already includes `just build`, so a full PR validation does not need a separate build step.
+- Prefer `just build` over ad hoc cargo invocations unless you are intentionally narrowing scope.

.skills/fix-jj-conflicts/SKILL.md

@@ -54,7 +54,7 @@ If unsure about the correct resolution, ask the user rather than guessing.
 Run:
 
 ```bash
-make check
+just check
 ```
 
 ### 4. Re-check remaining conflicts
@@ -73,7 +73,7 @@ After all conflicts are resolved, confirm no conflicts remain and verify the fin
 
 ```bash
 jj log -r '(<target-revset>) & conflicts()'
-make check
+just check
 ```
 
 ### 6. Cleanup

.skills/lint/SKILL.md

@@ -16,7 +16,7 @@ Run this skill after editing `.rs`, `.toml`, or `.md` files.
 ### 1. Format check
 
 ```bash
-make fmt
+just fmt
 ```
 
 This runs `dprint check` for Rust, TOML, and Markdown.
@@ -30,7 +30,7 @@ dprint fmt
 ### 2. Lint check
 
 ```bash
-make lint
+just lint
 ```
 
 ### 3. Common repo-specific lint expectations

.skills/run-rust-tests/SKILL.md

@@ -50,7 +50,7 @@ cargo test --doc -p <crate1> -p <crate2>
 ### `all`
 
 ```bash
-make test
+just test
 ```
 
 ### One crate
@@ -75,4 +75,4 @@ cargo test --doc -p <crate-name>
 ## Notes
 
 - `cargo nextest` does not run doctests in this repo.
-- Prefer targeted crate runs while iterating, then `make test` or `make check` at the end.
+- Prefer targeted crate runs while iterating, then `just test` or `just check` at the end.

.skills/split-jj-changeset/SKILL.md

@@ -88,7 +88,7 @@ The combined split should match the original.
 Run the validation plan agreed with the user. It is usually enough to run:
 
 ```bash
-make check
+just check
 ```
 
 Use narrower crate-level commands when appropriate during iteration.

.skills/verify/SKILL.md

@@ -16,7 +16,7 @@ Use this skill before opening a PR or handing work back to a reviewer.
 Run the repository's full local verification target:
 
 ```bash
-make check
+just check
 ```
 
 Ensure the new code adheres to the policies defined in [`rust-tests-guidelines`](../rust-tests-guidlines/SKILL.md) and [`rust-docs-guidelines`](../rust-docs-guidelines/SKILL.md).

AGENTS.md

@@ -5,11 +5,11 @@ Guidance for coding agents working in this repository.
 ## Key Commands
 
 ```bash
-make check # Run all local verification checks (CI parity)
-make fmt # dprint check (TOML + Markdown + Rust)
-make lint # cargo clippy --workspace -- -D warnings
-make test # cargo nextest run + cargo test --doc
-make build # cargo build --workspace
+just check # Run all local verification checks (CI parity)
+just fmt # dprint check (TOML + Markdown + Rust)
+just lint # cargo clippy --workspace -- -D warnings
+just test # cargo nextest run + cargo test --doc
+just build # cargo build --workspace
 ```
 
 Tests run via `cargo nextest` (process-per-test isolation); doctests run
@@ -20,7 +20,7 @@ Requires `protoc` installed for `firma-proto` protobuf compilation.
 ## Formatting
 
 `dprint` is the single formatter for the repo. Run `dprint fmt` after modifying
-`.toml`, `.md`, or `.rs` files. `make fmt` runs `dprint check` in CI.
+`.toml`, `.md`, or `.rs` files. `just fmt` runs `dprint check` in CI.
 
 `docs-site/` is excluded and uses its own toolchain.