fix(check): fail closed on malformed hubs + shared iter_hubs() helper

[Connorrmcd6]

Summary

Closes #35 and #36 (one logical change set — the issues recommend doing #36 first so #35 lands cleaner).

#36 — shared hub-iteration helper

Adds Workspace::iter_hubs() (surf-cli/src/workspace.rs) returning Vec<LoadedHub>, each carrying the parse Result<Hub, HubError> per-hub. I/O failure still hard-errors the run; the parse result — the thing that was being handled inconsistently across commands — is now surfaced so every caller must match on it. The four filesystem commands (check, lint, suggest, for) migrate onto it.

stats is intentionally not migrated: it reads hubs from git revisions (git::list_files_at + git::show), not the live filesystem via hub_paths(), so the filesystem-based helper doesn't fit it.

#35 — close the gate's fail-open paths

• An unparseable hub now emits an Unresolvable divergence (gate exits non-zero) instead of being silently continued.
• A hash error returns Unresolvable instead of .ok()? mapping it to "no divergence".

Tests

• New malformed_hub_blocks_check: a frontmatter typo produces one Unresolvable divergence with an invalid hub: … detail.
• The hash-failure branch is defensive: resolve() runs before hash_anchor_with, so a reachable input that resolves but fails to hash is not readily constructible; existing resolve-error tests already cover the Unresolvable path. No contrived test added.

Verification

• cargo test --all, cargo clippy --all-targets --all-features -- -D warnings, cargo fmt --all --check all pass.
• Manual: a scratch workspace with a broken hub makes surf check exit 1 with an UNRESOLVED line and a matching unresolvable JSON divergence.
• Dogfood: surf lint + surf check pass on this repo (the two anchored functions I edited, check_claim and find, were re-verified — their prose still holds).

🤖 Generated with Claude Code