"""ringcli — deterministic ring-design CLI: spec in, validated ring out."""