drift check: a 'report errors only' mode (suppress the per-doc ok output)

[flenter]

Summary

Add a mode to drift check that reports only failures (stale/broken docs) plus the summary line — suppressing the per-doc ok output entirely, on success and on failure.

Problem

drift check prints one block per doc. On a repo with many docs that's a wall of ok:

docs/a.md
  ok

docs/b.md
  ok

… (130+ more) …

1 doc stale, 136 ok

In a pre-push hook or CI step you only care about the failures, but they're buried. The existing --silent flag doesn't solve this: it suppresses output only when everything passes — the moment one doc is stale it prints the full report again (every ok block plus the one STALE), so the failure is buried in ~400 lines exactly when you need to see it.

So today there's no way to get "just the failures."

Request

A flag — --errors-only (or --quiet, or extend --silent) — where:

• success → print just the summary line (e.g. 137 ok), or nothing.
• failure → print only the stale/broken doc blocks and the summary (1 doc stale, 136 ok) — no ok blocks.
• exit code unchanged (0 pass / non-zero fail), so it stays usable as a gate.

Essentially: report errors only.

Current workaround (and why a native flag is better)

We currently wrap drift check and filter the ok blocks out of the text:

drift check "$@" | awk '
  BEGIN { RS = ""; ORS = "\n\n" }
  { keep = 1; n = split($0, l, "\n"); for (i=1;i<=n;i++) if (l[i] == "  ok") keep = 0; if (keep) print }
'
# exit code preserved via `set -o pipefail`

This works and safe-degrades (it only ever removes ok blocks, and the exit code is drift's, so the gate can't break) — but it parses drift's human-readable output, which isn't a stable contract. --format json (the versioned drift.check.v1 schema) is sturdier to parse but needs a JSON processor in the toolchain. A native flag would let consumers drop both the text-parsing and the extra dependency.

Acceptance criteria

• drift check --errors-only on a clean repo prints only the summary (or nothing) and exits 0.
• On a repo with a stale/broken doc, it prints only the stale/broken entries plus the summary, and exits non-zero.
• Composes with --changed <path>.