fix: address code-review findings from #13 (hardening + dead-code removal)

[NickMoignard]

Addresses the still-valid findings from #13 (see the re-review update). Scope agreed: must-fix correctness items + safe robustness/tests + removing the H1 dead plumbing.

Correctness / data-loss

• M1 — unbounded join recursion. join.resolve now caps !include nesting at maxIncludeDepth (100), surfaced as a clean InputError, so a corrupt/hostile split tree fails cleanly instead of a fatal goroutine-stack overflow. New deep-nesting regression test.
• M3 — non-atomic writes. yamltree.SaveFile/SaveRaw now write a temp file in the same dir and os.Rename into place. Protects both join --out (overwrite) and split's multi-file output tree from truncation/partial state on crash/interrupt/disk-full.
• M2 — swallowed filepath.Abs error. No longer keys the cycle guard by an ambiguous relative path; the (rare) Abs failure is surfaced.

H1 — remove dead plumbing

• Dropped the unused opts *globalOptions parameter from newSplitCmd/newJoinCmd/newVerifyCmd.
• Removed the built-but-unused internal/progress package + its CLI wrapper, and the now-orphaned schollz/progressbar dependency (go mod tidy).

Robustness / tests

• L2 — logLevelRank reports unknown levels ((int, bool)) instead of silently defaulting to error; EffectiveLogLevel falls back to the default level explicitly (with new rank constants).
• L1 — a missing root.yml now reports the directory the user passed, not a synthesized <dir>/root.yml.
• n3 — one shared package-level discard logger instead of per-miss allocation.
• n2 — comment explaining the fresh per-directory slug.NewNamer().
• g1 — the in-file anchor/alias test now joins and asserts the alias round-trips (*base preserved), not just that split accepts it.
• New guard — a test pinning canReconstruct's no-wrap precondition: a long single-line scalar nested deep must round-trip unwrapped. Fails if anyone adds SetWidth to yamltree.Save.

Deferred

• H1 full wiring (--output json + progress for subcommands) — not implemented; the plumbing was removed rather than wired, per the agreed scope. Worth a separate feature issue if -o json output is wanted.
• L3 (assert no subcommand overrides PersistentPreRunE) and cosmetic usage-string drift — left for a follow-up.

Validation

go build ./..., go vet ./..., go test -race ./..., and golangci-lint run ./... all clean.

Refs #13.

🤖 Generated with Claude Code