PY-PORT-2: port publishable_crates / package_include_diff / coverage_report_scope to Rust (C301) #4741

Operator rule C301: no Python in the build. Ruled by aprender-a7 (PY-PORT decision): ports go into one new unpublished crate, crates/aprender-ci-tools (publish = false, one bin with subcommands). Each Python original stays only as the external validator in an identical-output case table.

Scope: the top three from the Python inventory that PY-PORT-1 (cascade-publish helpers) does not cover:

• scripts/lib/publishable_crates.py
• scripts/lib/package_include_diff.py
• scripts/coverage_report_scope.py

Acceptance:

1. crates/aprender-ci-tools builds with publish = false. It has a clap-derive bin with subcommands publishable-crates, package-include-diff and coverage-report-scope.
2. scripts/tests/ci_tools_py_parity_test.sh shows stdout byte-identical to the .py original, and the same success or failure, on every case, including live cargo metadata. The test must not be vacuous: a planted mismatch must be detected, and a short run must fail.
3. The binary-debt ledger has a KEEP row, and the README and readme_contract checks are green.
4. FALSIFY-MONO-011: aprender-ci-tools is added to the [[bin]] allowlist with baseline 27 -> 28, in its own commit. This is sign-off row 38: it loosens a shrink-only list and waits for operator sign-off.
5. No caller is switched in this ticket, so CI behaviour is unchanged.

Branch py-port-2/ci-tools. Branch-only, no PR, until sign-off.

owner: aprender-flow (re-owned 2026-10-19 by aprender-triage-worker at the cop's word: previous owner session absent; picks up children only as batch constituents after its current timed task)

Folded sub-tickets (TRIAGE-100, 2026-10-14)

These open sub-tickets were folded here as checklist rows and closed as not planned so the open count stays at or under 100. Reopen one when its work resumes; an open PR for it reopens it.

• ARB-AUD-10b: python3 out of the release path — 12 scripts / 43 sites + release_wall_time.py, jq with a parity table per script #4352 — ARB-AUD-10b: python3 out of the release path — 12 scripts / 43 sites + release_wall_time.py, jq with a parity table per script — done when: git grep -n python3 -- scripts/release scripts/check_release_assets.sh scripts/check_publish_preflight.sh returns only comments, every script's parity table pas (branch: wip/4352-release-no-python)
• pr-review gate has no self-service path for fork/external contributors without pmat/agy/minisign #4462 — pr-review gate has no self-service path for fork/external contributors without pmat/agy/minisign
• One writer for derived contract files: README contract count, contracts/contracts.nt and the ONT-5 witness (the T21 roadmap.yaml rule) #4781 — One writer for derived contract files: README contract count, contracts/contracts.nt and the ONT-5 witness (the T21 roadmap.yaml rule)
• PY-PORT-2c: switch coverage_report_scope callers to aprender-ci-tools, delete the .py (C301) #4787 — PY-PORT-2c: switch coverage_report_scope callers to aprender-ci-tools, delete the .py (C301) (branch: chore/4787-coverage-scope-bin)
• PY-PORT-2b: port tarball_shrink_report.py to aprender-ci-tools #4788 — PY-PORT-2b: port tarball_shrink_report.py to aprender-ci-tools
• PY-PORT: port tarball_workspace.py to aprender-ci-tools tarball-workspace (C301) #4789 — PY-PORT: port tarball_workspace.py to aprender-ci-tools tarball-workspace (C301)
• PY-PORT-2d: port tarball_build_errors.py to aprender-ci-tools tarball-build-errors (C301) #4797 — PY-PORT-2d: port tarball_build_errors.py to aprender-ci-tools tarball-build-errors (C301)
• PY-PORT-2e: port llama_fit_verdict.py to aprender-ci-tools llama-fit-verdict (C301) #4799 — PY-PORT-2e: port llama_fit_verdict.py to aprender-ci-tools llama-fit-verdict (C301)
• PY-PORT: git_patch_id.py -> aprender-ci-tools git-patch-id (child of #4741) #4800 — PY-PORT: git_patch_id.py -> aprender-ci-tools git-patch-id (child of PY-PORT-2: port publishable_crates / package_include_diff / coverage_report_scope to Rust (C301) #4741)
• PY-PORT: crux-judge — retire the Python CRUX judge, oracles and certifier for tools/aprender-crux-judge (child of #4741) #4802 — PY-PORT: crux-judge — retire the Python CRUX judge, oracles and certifier for tools/aprender-crux-judge (child of PY-PORT-2: port publishable_crates / package_include_diff / coverage_report_scope to Rust (C301) #4741)
• PY-PORT: port tarball_test_run.py to aprender-ci-tools tarball-test-run (C301) #4812 — PY-PORT: port tarball_test_run.py to aprender-ci-tools tarball-test-run (C301)
• PY-PORT: crux_missing_stories.py -> aprender-ci-tools crux-missing-stories (child of #4741) #4816 — PY-PORT: crux_missing_stories.py -> aprender-ci-tools crux-missing-stories (child of PY-PORT-2: port publishable_crates / package_include_diff / coverage_report_scope to Rust (C301) #4741)
• PY-PORT-2f: port perf041_report.py to aprender-ci-tools perf041-report (C301) #4818 — PY-PORT-2f: port perf041_report.py to aprender-ci-tools perf041-report (C301)
• PY-PORT-2g: port annotate-book-examples.py to aprender-ci-tools annotate-book-examples (C301) #4822 — PY-PORT-2g: port annotate-book-examples.py to aprender-ci-tools annotate-book-examples (C301)
• PY-PORT: obligation_ids.py -> aprender-ci-tools obligation-ids (child of #4741) #4823 — PY-PORT: obligation_ids.py -> aprender-ci-tools obligation-ids (child of PY-PORT-2: port publishable_crates / package_include_diff / coverage_report_scope to Rust (C301) #4741)
• PY-PORT-2h: port extract_book_examples.py to aprender-ci-tools extract-book-examples (C301) #4826 — PY-PORT-2h: port extract_book_examples.py to aprender-ci-tools extract-book-examples (C301)
• PY-PORT: lockfile_registry_packages.py -> aprender-ci-tools lockfile-registry-packages #4827 — PY-PORT: lockfile_registry_packages.py -> aprender-ci-tools lockfile-registry-packages
• port the nextest fail-fast guard's embedded Python TOML reader to Rust (C301) #5032 — port the nextest fail-fast guard's embedded Python TOML reader to Rust (C301) (branch: la-72/5032-nextest-reader-rust) — reopened 2026-10-14 as a 0.72.0 floor row; tracked on its own ticket, not here
• PY-PORT-2f: port model_ladder_cells_produce.py to aprender-ci-tools ladder-cells-produce (C301) #5225 — PY-PORT-2f: port model_ladder_cells_produce.py to aprender-ci-tools ladder-cells-produce (C301) (branch: PMAT-5225-ladder-cells-produce-port) — reopened 2026-10-14 as a 0.72.0 floor row; tracked on its own ticket, not here

Children tracked here (REDUCE-1022)

• port the nextest fail-fast guard's embedded Python TOML reader to Rust (C301) #5032 — port the nextest fail-fast guard's embedded Python TOML reader to Rust (C301) (closed: not planned)
• Python-oracle tests silently pass when python3 is absent #5373 — Python-oracle tests silently pass when python3 is absent (closed: not planned)
• Ban inventory: rewrite stub_server.py (runtime-generated test stub) in bash/Rust #5864 — Ban inventory: rewrite stub_server.py (runtime-generated test stub) in bash/Rust (closed: not planned)
• Ban inventory: rewrite scripts/lib/crux_fake_serve.py in bash/Rust #5865 — Ban inventory: rewrite scripts/lib/crux_fake_serve.py in bash/Rust (closed: not planned)
• Ban inventory: rewrite scripts/ci/fat_driver.py in bash/Rust #5866 — Ban inventory: rewrite scripts/ci/fat_driver.py in bash/Rust (closed: not planned)
• Port scripts/lib/roadmap_fragments.py (and roadmap_diff/roadmap_merge) to Rust #5902 — Port scripts/lib/roadmap_fragments.py (and roadmap_diff/roadmap_merge) to Rust (open)
• LAB: check_roadmap_completion_is_cited.sh self-test row hits live GitHub and flakes (PR #2733 is MERGED) #5910 — LAB: check_roadmap_completion_is_cited.sh self-test row hits live GitHub and flakes (PR batch: seven receipt-rule sub-tickets — guards that named the code for a broken host, and a gate green on its own fixture #2733 is MERGED) (closed: not planned)