build(cli): flip Justfile install + packaging to launcher (#44)

[hyperpolymath]

Summary

Flips the dev install (just install) and Linux packaging recipes (.deb, .rpm) from the legacy Zig CLI binary to the wasmtime-host gossamer-launcher + precompiled cli.wasm.

Why draft

This is the second half of Phase 14b. Gated on #42 (subcommand body port) — with the current stub bodies in `cli/src/Main.eph`, the flipped `gossamer dev/build/run/bundle/init` will print only their banner and a status integer rather than actually opening a webview / running the build. Don't merge until #42 lands (or merge them as a coordinated roll).

Changes

`Justfile`

• New `build-launcher` / `build-launcher-release` recipes — wrap `cli/launcher` zig build, threading `EPHAPAX` through so `cli.wasm` is compiled in the same step.
• `install` now copies `gossamer-launcher` → `/.local/bin/gossamer` and `cli.wasm` → `/.local/share/gossamer/cli.wasm`. The launcher's install-prefix-relative discovery (`<exe_dir>/../share/gossamer/cli.wasm` — see `cli/launcher/src/main.zig:266`) finds the wasm at runtime.
• `package-deb` / `package-rpm` depend on `build-launcher-release`.

`packaging/debian/{gossamer.install,rules}`

• Source paths under `cli/launcher/zig-out`.
• Launcher binary installed as `gossamer` to preserve UX.
• `cli.wasm` lands in `usr/share/gossamer/`.

`packaging/rpm/gossamer.spec`

• Builds via `build-launcher-release`.
• Launcher installed as `gossamer` under `%{_bindir}`; `cli.wasm` under `%{_datadir}/gossamer/`.
• wasmtime + ephapax noted as out-of-tree dependencies.

Test plan

• Local: `just install` then `/.local/bin/gossamer version` finds `/.local/share/gossamer/cli.wasm` and prints v2-grammar Ephapax banner + status 110+
• Local: `just package-deb` (with libwasmtime + ephapax on PATH) produces a .deb whose `gossamer` binary discovers `/usr/share/gossamer/cli.wasm`
• CI: existing workflows still pass (this PR doesn't touch CI — but ci(e2e): install libwasmtime + clear baseline-rot blockers #42 changes will exercise the new install layout)

Refs

• ci(e2e): install libwasmtime + clear baseline-rot blockers #42 — Phase 14b subcommand body port (this PR is gated on that)
• docs(readme): disclose class-J axiom + 13/13 build posture (Refs standards#131) #43 — GTK blocking-thread design (closed)
• docs(launcher): resolve gossamer_run GTK blocking-thread design (#43) #45 — GTK design doc (companion to this PR)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 27 issues detected

Severity	Count
🔴 Critical	11
🟠 High	4
🟡 Medium	12

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/IPCDispatch.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/ResourceCleanup.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/GrooveTermination.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/HandleLinearity.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/WindowStateMachine.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence