Builder workflow

The CLI performs a small, ordered workflow:

1. Refresh the cached shared dictionary only when the configured authority is newer than the valid local cache.
2. Load the cached dictionary and merge typos.local.toml when the overlay is present.
3. Render typos.toml deterministically.
4. Atomically write the rendered content, or compare it with the tracked file when --check is set.

The refresh operation preserves a valid cache when the configured authority is temporarily unavailable. With the default source, a run that has no valid cache and cannot reach the authority falls back to the bundled snapshot, so shared policy can always be established; an explicit --source has no such fallback and fails instead.

The gate command performs the same workflow in write mode and then runs the pinned Typos binary and the phrase check, so a consumer needs no separate Typos invocation. Entries under [phrases.corrections] are never rendered, because Typos tokenizes hyphenated phrases as separate words and would silently ignore them; the gate applies them itself.