feat(cli): deprecate validate, inspect, layout in favor of check

One stderr notice per invocation and _meta.deprecated: true in JSON mode
(shared helper next to withMeta; layout owns both inspect and layout via
createInspectCommand). Help descriptions gain the pointer. No behavior
change; removal ships separately once migration telemetry says usage
has decayed.

fix(producer): route info/debug logs to stderr — the compiler's
'Localized remote media' line was landing on stdout ahead of validate's
--json payload, breaking every piped consumer. Diagnostics now share
stderr with warn/error; render progress uses its own channel.

packages/cli/src/utils/updateCheck.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { isSafeVersion } from "./updateCheck.js";
+import { isSafeVersion, printDeprecationNotice, withMeta } from "./updateCheck.js";
 
 describe("isSafeVersion", () => {
   it("accepts strict semver, incl. prerelease/build metadata", () => {
@@ -150,6 +150,68 @@ async function checkWith(registryVersion: unknown): Promise<{
   }
 }
 
+/**
+ * U5: validate/inspect/layout are deprecated in favor of `check`. withMeta's
+ * optional `{ deprecated: true }` is the single place that adds `_meta.deprecated`
+ * to a --json envelope; every other command (check, lint, ...) calls withMeta
+ * with no second argument and must never see the key at all — not even `false`.
+ */
+describe("withMeta — deprecated flag", () => {
+  it("omits _meta.deprecated entirely when no options are passed (check/lint et al.)", () => {
+    const wrapped = withMeta({ ok: true });
+    expect("deprecated" in wrapped._meta).toBe(false);
+  });
+
+  it("omits _meta.deprecated when options.deprecated is false", () => {
+    const wrapped = withMeta({ ok: true }, { deprecated: false });
+    expect("deprecated" in wrapped._meta).toBe(false);
+  });
+
+  it("sets _meta.deprecated === true when requested (validate/inspect/layout)", () => {
+    const wrapped = withMeta({ ok: true }, { deprecated: true });
+    expect(wrapped._meta.deprecated).toBe(true);
+  });
+
+  it("preserves the rest of the _meta envelope alongside the deprecated flag", () => {
+    const wrapped = withMeta({ ok: true }, { deprecated: true });
+    expect(wrapped._meta.version).toEqual(expect.any(String));
+    expect(typeof wrapped._meta.updateAvailable).toBe("boolean");
+  });
+});
+
+/**
+ * The stderr-only deprecation notice: printed once per invocation, never on
+ * stdout, so --json output stays pure JSON while humans still see the notice.
+ */
+describe("printDeprecationNotice", () => {
+  it("writes exactly one line to stderr, never stdout", () => {
+    const stderrWrites: string[] = [];
+    const stdoutWrites: string[] = [];
+    const origErrWrite = process.stderr.write.bind(process.stderr);
+    const origOutWrite = process.stdout.write.bind(process.stdout);
+    process.stderr.write = ((chunk: unknown) => {
+      stderrWrites.push(String(chunk));
+      return true;
+    }) as typeof process.stderr.write;
+    process.stdout.write = ((chunk: unknown) => {
+      stdoutWrites.push(String(chunk));
+      return true;
+    }) as typeof process.stdout.write;
+
+    try {
+      printDeprecationNotice("validate");
+    } finally {
+      process.stderr.write = origErrWrite;
+      process.stdout.write = origOutWrite;
+    }
+
+    expect(stdoutWrites).toEqual([]);
+    expect(stderrWrites).toHaveLength(1);
+    expect(stderrWrites[0]).toContain("hyperframes validate");
+    expect(stderrWrites[0]).toContain("hyperframes check");
+  });
+});
+
 describe("checkForUpdate — registry boundary guard", () => {
   afterEach(() => {
     vi.doUnmock("../telemetry/config.js");