rebrand to notevi: one CLI over the jj sidecar

vr and vrsite become a single binary. vrsite/ folds into a web package in
one module (0x4200.cafe/notevi); "notevi web" serves and exports exactly
what vrsite did, and "notevi read/grep/note/query" is unchanged.

The sidecar is renamed with it: notevi_log, notevi-log.jsonl, and the
description "private: notevi log". The pre-rebrand names are still
recognized, so an old repository opens and reads; it is renamed in place
on the first write, or up front with "notevi migrate DIR...".

That rename cannot be a single mv inside jj run. jj only auto-tracks a
*new* file in the run working copy below a size limit it does not take
from the command line, so writing a whole log under a name the change has
never held is silently dropped while jj reports success. ensureLogFile
creates the file empty first and lets every later byte be a modification
of a tracked file, which snapshots at any size; that also fixes the same
latent bug when importing a large legacy vr-log.jsonl.

Adds a bem-te-vi mark (favicon and nav brand) and a README.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

1 files changed, 19 insertions, 0 deletions

diff --git a/constrain/notevi-only-guard.sh b/constrain/notevi-only-guard.sh
new file mode 100755
index 0000000..729f4d4
--- /dev/null
+++ b/constrain/notevi-only-guard.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Claude Code PreToolUse hook (matcher: Bash): deny shell commands that read
+# files without going through notevi. A guardrail, not a jail — it catches the
+# common readers at command position, not every conceivable bypass.
+cmd=$(jq -r '.tool_input.command // empty')
+
+readers='cat|head|tail|less|more|sed|awk|cut|rg|grep|egrep|fgrep|find|fd|strings|xxd|hexdump|od|tac|nl'
+pattern='(^|[;&|(`]|\$\()[[:space:]]*('$readers')([[:space:]]|$)'
+
+if printf '%s' "$cmd" | grep -qE "$pattern"; then
+  echo "blocked: read/search files only through notevi (run 'notevi -doc' for usage)" >&2
+  exit 2
+fi
+vcs='jj[[:space:]]+(file[[:space:]]+show|diff)|git[[:space:]]+(show|diff|grep|cat-file|blame|log)'
+if printf '%s' "$cmd" | grep -qE "(^|[;&|(\`])[[:space:]]*($vcs)"; then
+  echo "blocked: use 'notevi read -r REV FILE' / 'notevi grep -r REV' instead of raw jj/git reads" >&2
+  exit 2
+fi
+exit 0