feat(for): add surf for <path> reverse lookup (#31)

[Connorrmcd6]

Summary

Surface's pitch is that hubs/ give documentation a standard home people and agents actually find — but there was no command for the inverse of authoring: "I'm about to edit this file, which claims govern it?" suggest only finds unanchored functions; check/lint don't expose a per-path view. This delivers that discoverability half of the thesis.

Changes

• New surf for <path> [symbol] [--format human|json] — lists every hub + claim anchored into <path>, optionally narrowed to anchors whose first segment matches symbol.
• Reuses the existing hub/anchor machinery and matches on the anchored path only — no source parse, no model, no network. Stays deterministic and dependency-free.
• A query, not a gate: always exits 0, whether or not anything matched.
• --format json emits a versioned {version, path, matches} envelope for agents.
• Path is normalized to workspace-root-relative (strips a leading ./, relativizes an absolute path under the root).

Out of scope (per #31): git-moved-path resolution and blast-radius / call-graph analysis (those drift and would break the no-model/no-network core).

Verification

• Unit tests: finds all claims for a file, symbol narrowing, empty result, path normalization, versioned JSON envelope.
• End-to-end against this repo's own hubs: surf for surf-cli/src/check.rs lists both its claims; narrowing to a symbol returns one; a path with no anchors reports empty and exits 0; JSON envelope verified.
• Dogfood: added hubs/cli-for.md documenting the new command; surf lint and surf check stay green (the CLI command-list hub was updated to include for).

Closes #31.

🤖 Generated with Claude Code