feat(cya): T01-T07 core console-native MVP slice (CYA-WP-0001)

- T01: Python + Typer/rich + pyproject.toml + full src/ layout + working `cya` CLI entrypoint
- T02: Bounded transparent context collector (top-level only, provenance, ignores) + --explain-context
- T03: Genuine rule-based risk classifier (primary) + mandatory terminal confirmation, no auto-execute
- T04: LLMAdapter Protocol + deterministic FakeLLMAdapter seam (llm-connect boundary, zero bypass)
- T05: Strictly minimal phase-memory no-op ports (loud markers, per operator direction 2026-05-26)
- T06: Orchestrator coordinating the full flow; CLI is thin delegation
- T07: pytest harness + safety-focused tests (risk invariants + collector)

All changes verified by running the installed `cya` binary and `pytest tests/`.

Workplan updated with status. State Hub progress event logged (workstream 0a1233fd...).

Refs: CYA-WP-0001, Decision a644364b-11c4-49a9-bf17-99063382e27b

tests/test_collector.py

@@ -0,0 +1,33 @@
+"""Tests for the bounded context collector (T02 + T07).
+
+Focus on the hard constraints:
+- Never recurses.
+- Respects the ignore list for dangerous/expensive locations.
+- Always produces a serializable envelope with provenance.
+"""
+
+from cya.context.collector import collect, ContextEnvelope
+
+
+def test_collect_returns_envelope():
+    env = collect(".")
+    assert isinstance(env, ContextEnvelope)
+    assert env.cwd
+    assert isinstance(env.top_level, list)
+    assert env.collected_at
+
+
+def test_collect_is_non_recursive_and_filters():
+    env = collect(".")
+    # We should never have deep nested paths in top_level for this collector
+    for entry in env.top_level:
+        assert "/" not in entry.get("name", "")
+        assert "\\" not in entry.get("name", "")
+
+
+def test_collect_is_serializable():
+    env = collect(".")
+    d = env.to_dict()
+    assert isinstance(d, dict)
+    assert "cwd" in d
+    assert "top_level" in d