Add lint/security/doc-check tooling from next, without CI wiring

Pull over the rake tasks CLAUDE.md already assumes exist here (lint,
security, doc:check/doc:lint/doc:links) plus their gemspec dev
dependencies (awesome_bot, mdl, bundler-audit) and mdl config, matching
next's tooling. Available to run locally/manually.

Deliberately not wired into CI yet: rake lint and rake doc:check both
fail against master's pre-existing content (the RuboCop offenses noted
in earlier commits this session, and README.md's older heading/code-
block style predating these markdown-lint conventions). Wiring a new
CI job today would go red immediately on unrelated debt; that cleanup
is separate, larger scope. rake security passes clean as-is.

Author: evolve75

.mdlrc

@@ -0,0 +1 @@
+style "#{File.join(File.dirname(__FILE__), 'mdl_style.rb')}"

Gemfile.lock

@@ -8,12 +8,35 @@ GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.2)
+    awesome_bot (1.20.0)
+      parallel (= 1.20.1)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
+    chef-utils (19.3.15)
+      concurrent-ruby
+    concurrent-ruby (1.3.8)
     date (3.4.1)
     diff-lcs (1.5.1)
     docile (1.4.1)
     json (2.21.2)
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
     language_server-protocol (3.17.0.3)
-    parallel (1.26.3)
+    mdl (0.14.0)
+      kramdown (~> 2.3)
+      kramdown-parser-gfm (~> 1.1)
+      mixlib-cli (~> 2.1, >= 2.1.1)
+      mixlib-config (>= 2.2.1, < 4)
+      mixlib-shellout
+    mixlib-cli (2.1.8)
+    mixlib-config (3.0.27)
+      tomlrb
+    mixlib-shellout (3.3.8)
+      chef-utils
+    parallel (1.20.1)
     parser (3.3.6.0)
       ast (~> 2.4.1)
       racc
@@ -27,6 +50,7 @@ GEM
     rdoc (6.10.0)
       psych (>= 4.0.0)
     regexp_parser (2.9.3)
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -70,6 +94,8 @@ GEM
     stringio (3.1.2)
     test-unit (3.6.7)
       power_assert
+    thor (1.5.0)
+    tomlrb (2.0.4)
     unicode-display_width (3.1.2)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
@@ -79,7 +105,10 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  awesome_bot (~> 1.20)
   bundler (~> 2.3)
+  bundler-audit (~> 0.9)
+  mdl (~> 0.14)
   rake (~> 13.2)
   rdoc (~> 6.10)
   rspec (~> 3.0, >= 3.13)

Rakefile

@@ -42,6 +42,9 @@ GEM_SPEC = Bundler.load_gemspec(File.join(__dir__, 'rubytree.gemspec'))
 PKG_NAME = GEM_SPEC.name
 PKG_VER  = GEM_SPEC.version
 GEM_NAME = "#{PKG_NAME}-#{PKG_VER}.gem"
+MARKDOWN_FILES = Dir['**/*.md'].reject do |path|
+  path.start_with?('vendor/', 'pkg/')
+end.sort
 
 desc 'Default Task (Run the tests)'
 task :default do
@@ -98,6 +101,19 @@ namespace :doc do # ................................ Documentation
   task :clobber_yard do
     rm_rf 'doc'
   end
+
+  desc 'Run markdown lint checks'
+  task :lint do
+    sh('mdl', '--config', '.mdlrc', *MARKDOWN_FILES)
+  end
+
+  desc 'Validate http(s) links in markdown files'
+  task :links do
+    sh('awesome_bot', *MARKDOWN_FILES, '--allow-redirect', '--allow-dupe')
+  end
+
+  desc 'Run markdown lint and link checks'
+  task check: %i[lint links]
 end
 
 desc 'Run the unit tests'
@@ -181,3 +197,32 @@ RuboCop::RakeTask.new(:rubocop) do |t|
   t.requires << 'rubocop-rake'
   t.requires << 'rubocop-rspec'
 end
+
+# ................................ Gem metadata
+desc 'Validate gemspec metadata and required fields'
+task :gemspec do
+  GEM_SPEC.validate
+  puts 'Gemspec is valid.'
+end
+
+# ................................ Linting
+desc 'Run lint checks'
+task lint: %i[gemspec rubocop]
+
+# ................................ Security checks
+desc 'Run security checks (bundler-audit, semgrep)'
+task :security do
+  sh('bundle', 'exec', 'bundler-audit', 'check', '--update')
+
+  semgrep_available = system('command -v semgrep >/dev/null 2>&1')
+  unless semgrep_available
+    warn 'WARN: semgrep not found; skipping semgrep security scan.'
+    return
+  end
+
+  env = {}
+  default_cert = '/etc/ssl/cert.pem'
+  env['SSL_CERT_FILE'] = default_cert if ENV['SSL_CERT_FILE'].nil? && File.exist?(default_cert)
+
+  sh(env, 'semgrep', '--config', 'p/r2c-security-audit', '--config', 'p/ruby', 'lib')
+end

mdl_style.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+all
+rule 'MD029', style: 'one_or_ordered'
+exclude_rule 'MD032'
+exclude_rule 'MD041'
+exclude_rule 'MD013'

rubytree.gemspec

@@ -67,7 +67,10 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'json', '~> 2.0', '>= 2.21.2'
 
   # NOTE: Rake is added as a development and test dependency in the Gemfile.
+  s.add_development_dependency 'awesome_bot', '~> 1.20'
   s.add_development_dependency 'bundler', '~> 2.3'
+  s.add_development_dependency 'bundler-audit', '~> 0.9'
+  s.add_development_dependency 'mdl', '~> 0.14'
   s.add_development_dependency 'rake', '~> 13.2'
   s.add_development_dependency 'rdoc', '~> 6.10'
   s.add_development_dependency 'rspec', '~> 3.0', '>= 3.13'