The rule against invoking tools directly now names the script/ scripts
as the single source of truth and allows calling them directly. The
Makefile targets must still exist as thin shims. The one-package
go test exception is unchanged.
Model: opus-5-5
sneak