feat(local-identity): implement Stage 1 — core file store (NK-WP-0002-T01)

Deliverables:
- src/local_identity/gecos.py: /etc/passwd GECOS parsing, current_username()
- src/local_identity/user.py: UserRecord dataclass, ProductionIdentity, make_test_user()
  - Pure test-user derivation: <user>N / +testN email alias / source_user tracking
- src/local_identity/store.py: file store CRUD backed by LOCAL_IDENTITY_HOME
  - ~/.local-identity/ mode 700, user files mode 600
  - All path lookups dynamic (env-var override enables clean test isolation)
- src/local_identity/cli.py: init/list/show commands; email from flag > config > prompt
- pyproject.toml + uv.lock: pyyaml dep, local-identity script entry point

Tests (41 passing):
- test_gecos.py: 9 tests — simple/comma/empty/non-ASCII/whitespace GECOS, fallback
- test_user.py: 14 tests — test-user derivation, YAML roundtrip, non-ASCII, idempotency
- test_store.py: 18 tests — dir creation, permissions (700/600), CRUD, list, config,
  idempotency (reinit with --force produces identical users)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

local-identity/src/local_identity/cli.py

@@ -0,0 +1,123 @@
+"""
+local-identity CLI — entry point.
+
+Commands:
+  init [--force] [--email EMAIL]   Derive primary user from Linux identity,
+                                   generate test users, write store.
+  list                             List all users in the store.
+  show <username>                  Display a user's YAML record.
+
+Environment:
+  LOCAL_IDENTITY_HOME   Override the store directory (default: ~/.local-identity).
+"""
+
+import argparse
+import sys
+
+from .gecos import current_username, get_gecos_fullname
+from .user import UserRecord, make_test_user
+from . import store
+
+
+def cmd_init(args: argparse.Namespace) -> None:
+    if store.store_exists() and not args.force:
+        print(
+            f"Store already exists at {store._store_dir()}. "
+            "Use --force to reinitialise.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    username = current_username()
+    fullname = get_gecos_fullname(username)
+
+    # Email resolution: flag > existing config > interactive prompt
+    config = store.read_config() if store.store_exists() else {}
+    email: str = args.email or config.get("email", "")
+    if not email:
+        try:
+            email = input(f"Email address for {username}: ").strip()
+        except EOFError:
+            email = ""
+        if not email:
+            print("Error: email address is required.", file=sys.stderr)
+            sys.exit(1)
+
+    store.init_dirs()
+    config["email"] = email
+    store.write_config(config)
+
+    primary = UserRecord(username=username, fullname=fullname, email=email)
+    store.write_user(primary)
+
+    test1 = make_test_user(primary, 1)
+    test2 = make_test_user(primary, 2)
+    store.write_user(test1)
+    store.write_user(test2)
+
+    print(f"Initialised local-identity store at {store._store_dir()}")
+    print(f"  Primary : {primary.username}  ({primary.fullname})  <{primary.email}>")
+    print(f"  Test 1  : {test1.username}  <{test1.email}>")
+    print(f"  Test 2  : {test2.username}  <{test2.email}>")
+
+
+def cmd_list(args: argparse.Namespace) -> None:
+    users = store.list_users()
+    if not users:
+        print("No users found. Run 'local-identity init' first.")
+        return
+    header = f"{'USERNAME':<20} {'FULLNAME':<30} {'EMAIL':<40} TYPE"
+    print(header)
+    print("-" * len(header))
+    for u in users:
+        utype = "test   " if u.generated else "primary"
+        print(f"{u.username:<20} {u.fullname:<30} {u.email:<40} {utype}")
+
+
+def cmd_show(args: argparse.Namespace) -> None:
+    try:
+        user = store.read_user(args.username)
+    except FileNotFoundError as exc:
+        print(str(exc), file=sys.stderr)
+        sys.exit(1)
+    print(user.to_yaml(), end="")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="local-identity",
+        description="Zero-dependency bootstrap user store for net-kingdom environments.",
+        epilog=(
+            "Store location: ~/.local-identity  "
+            "(override with LOCAL_IDENTITY_HOME)"
+        ),
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_init = sub.add_parser(
+        "init",
+        help="Initialise store from Linux identity",
+    )
+    p_init.add_argument(
+        "--force", action="store_true",
+        help="Reinitialise even if the store already exists",
+    )
+    p_init.add_argument(
+        "--email",
+        help="Email address (skips interactive prompt)",
+    )
+    p_init.set_defaults(func=cmd_init)
+
+    p_list = sub.add_parser("list", help="List all users in the store")
+    p_list.set_defaults(func=cmd_list)
+
+    p_show = sub.add_parser("show", help="Display a user record")
+    p_show.add_argument("username", help="Username to display")
+    p_show.set_defaults(func=cmd_show)
+
+    args = parser.parse_args()
+    args.func(args)
+
+
+if __name__ == "__main__":
+    main()