feat: name undefined variables when secrets_inventory is missing (#55)

[Zorlin]

Closes #55 (the deferred var-naming enhancement).

What

When secrets_inventory is declared but absent in a non-mutating run, the notice names the variables that would be undefined — exactly, with no false positives or negatives:

note: secrets_inventory not found … Without it these referenced variables
would be undefined (…): api_token

The diagnostic is proven exact (per-play scope)

A template renders per host, so the precise semantics is per-(play, host). The implementation uses the per-play intersection formula

Missing_p = R(p) \ ( D(p) ∪ G ∪ B ∪ ⋂_{h ∈ H(p)} I(h) )

Lean proof (proofs/secrets_scope.lean, missing_per_play_exact, no mathlib) proves this equals the per-(play,host) semantics ⋃_{h∈H(p)}(R(p)\(D(p)∪G∪B∪I(h))), for arbitrary targets H (empty included). 20,000 brute-force instances (proofs/secrets_scope_theory.py) agree: 0 exactness failures.

This replaced a run-wide-union approximation that had two error modes the formal model exposed:

• under-report: a var defined only in a non-targeted group's hosts (e.g. group_vars/gB, play targets gA) — the union hid it; the intersection catches it.
• over-report: a var referenced by a play that targets no host — the union flagged it; exact contributes nothing.

Templated/unknown play.groups can't be resolved statically, so those plays fall back to the sound union view (may under-report) rather than guess targets.

Approach — reuse the engine, no new dependency

handlebars's Template::compile is parse-only (never renders), so it extracts references even from templates the engine would refuse to render — exactly the missing-variable case. Reusing it means the result can never disagree with what renders.

• src/playbooks/template_refs.rs — referenced_variables() walks the AST (bare vars, helpers skip name/keep params, {{#each}}/{{#if}}, as |item| alias scoping, subexpressions, locals, literals, nested→top-level). referenced_variables_in_value() recurses through !tagged task nodes for every string leaf — all task types inline, no per-variant matching.
• src/playbooks/ref_collector.rs — collect_per_play() returns per-play { groups, referenced, defined } (mirrors traversal's role/task/template resolution via extracted resolve_role, no chdir); parses each task file twice (generic Value for inline + typed Vec<Task> to follow !template src).
• src/cli/secrets_diagnostic.rs — applies the exact formula per play.
• main.rs — notice enriched with the list when inventory is loaded.

Tests & verification

• 417 tests green; cargo fmt + cargo clippy clean. New exactness tests pin both cases the approximation got wrong (flags_a_var_defined_only_in_a_non_targeted_group, empty_target_play_contributes_nothing).
• End-to-end: a real tree under plan with a declared-missing secrets_inventory references api_token/public_var/jet_hostname → notice names only api_token.

🤖 Generated with Claude Code