gateway: pub extract_json + parity_extract_json bin (cross-runtime probe)

Supports the 2026-05-02 cross-runtime parity probe at
golangLAKEHOUSE/scripts/cutover/parity/extract_json_parity.sh which
feeds identical model-output strings through both runtimes' extract_json
and diffs results.

## Changes
- crates/gateway/src/v1/iterate.rs: extract_json gains `pub` + a
  comment pointing at the Go counterpart and the parity probe path
- crates/gateway/src/lib.rs: NEW thin lib facade re-exporting the
  modules so sub-binaries can reuse them. main.rs is unchanged
  (still uses local mod declarations)
- crates/gateway/src/bin/parity_extract_json.rs: NEW ~30-LOC binary
  that reads stdin, calls extract_json, prints {matched, value} JSON

## Probe result (logged in golangLAKEHOUSE)
12/12 match across fenced blocks, nested objects, unicode, escaped
quotes, top-level array, malformed JSON. Both runtimes' algorithms
are genuinely equivalent.

Substrate gate the probe enforces: `cargo test -p gateway extract_json`
PASS before any parity comparison runs. So a future divergence in
the live extract_json fires either as a Rust test failure (live
behavior changed) or a probe diff (Go behavior changed) — never
silently.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/gateway/src/bin/parity_extract_json.rs

@@ -0,0 +1,37 @@
+//! Cross-runtime parity helper for `extract_json`.
+//!
+//! Reads a single model-output string from stdin, runs the Rust
+//! extract_json, prints `{"matched": bool, "value": <object|null>}`
+//! to stdout as JSON. Exit 0 on success, exit 1 on internal error.
+//!
+//! The Go counterpart lives at
+//! `golangLAKEHOUSE/internal/validator/iterate.go::ExtractJSON`. The
+//! parity probe at
+//! `golangLAKEHOUSE/scripts/cutover/parity/extract_json_parity.sh`
+//! feeds the same fixtures through both and diffs the outputs.
+//!
+//! Usage:
+//!   echo '<raw model output>' | parity_extract_json
+//!   parity_extract_json <<< '...'
+
+use std::io::Read;
+
+fn main() {
+    let mut buf = String::new();
+    if let Err(e) = std::io::stdin().read_to_string(&mut buf) {
+        eprintln!("read stdin: {e}");
+        std::process::exit(1);
+    }
+    let result = gateway::v1::iterate::extract_json(&buf);
+    let body = serde_json::json!({
+        "matched": result.is_some(),
+        "value": result.unwrap_or(serde_json::Value::Null),
+    });
+    match serde_json::to_string(&body) {
+        Ok(s) => println!("{s}"),
+        Err(e) => {
+            eprintln!("serialize result: {e}");
+            std::process::exit(1);
+        }
+    }
+}

crates/gateway/src/lib.rs

@@ -0,0 +1,19 @@
+//! Library facade for the gateway crate so sub-binaries (e.g.
+//! `parity_extract_json`) can reuse the same modules the gateway
+//! binary uses.
+//!
+//! Added 2026-05-02 to support the cross-runtime parity probe at
+//! `golangLAKEHOUSE/scripts/cutover/parity/extract_json_parity.sh`.
+//! `extract_json` is the load-bearing public surface for that probe.
+//!
+//! main.rs still uses local `mod foo;` declarations independently —
+//! adding this file is purely additive (the binary's module tree is
+//! unchanged).
+
+pub mod access;
+pub mod access_service;
+pub mod auth;
+pub mod execution_loop;
+pub mod observability;
+pub mod tools;
+pub mod v1;

crates/gateway/src/v1/iterate.rs

@@ -234,7 +234,13 @@ async fn call_validate(client: &reqwest::Client, gateway: &str, body: &serde_jso
 /// Extract the first JSON object from a model's output. Handles
 /// fenced code blocks (```json ... ```), bare braces, and stray
 /// prose around the JSON. Returns None on no extractable object.
-fn extract_json(raw: &str) -> Option<serde_json::Value> {
+///
+/// Made `pub` 2026-05-02 to support the cross-runtime parity probe
+/// at `golangLAKEHOUSE/scripts/cutover/parity/extract_json_parity.sh`.
+/// The Go counterpart lives at `internal/validator/iterate.go::ExtractJSON`;
+/// when either runtime's algorithm changes the parity probe surfaces
+/// the divergence.
+pub fn extract_json(raw: &str) -> Option<serde_json::Value> {
     // Try fenced first.
     let candidates: Vec<String> = {
         let mut out = vec![];