feat(gossamer): prep for end-to-end .eph→.wasm compile (#196)

[hyperpolymath]

Refs #196.

Status

Upstream blocker still open — hyperpolymath/ephapax#36 (the single .eph → .wasm CLI subcommand) is currently unresolved. The workflow already auto-promotes when any of just compile-affine, ephapax-cli compile-eph, or ephapax-cli compile-affine ships upstream, so the compile step itself still skips on this PR. This PR lands the hypatia-side DoD items that can be done without the upstream so the moment ephapax#36 merges, CI produces a validated artifact and loader.js is ready to run it.

Changes

.github/workflows/build-gossamer-gui.yml

• Install wabt after a successful compile and run wasm-validate on the produced hypatia_gui.wasm.
• Gate the Upload wasm artifact step on wasm-validate success.
• Summary now reports the validation result and links the upstream blocker.

src/ui/gossamer/loader.js

• Replace the wasi_snapshot_preview1 stub with a gossamer import namespace whose surface mirrors the extern "gossamer" block in bridge.eph (window/IPC handles + JSON helpers).
• Browser stubs are minimal but sufficient to instantiate the module so the TEA exports (hypatia_init / _update / _view / _subs) remain callable from index.html.
• readString keeps the {ptr, leading-i32-len} convention but adds bounds checks so an Ephapax ABI mismatch surfaces as a clear RangeError instead of a silent garble. Single point of change once the ABI is pinned upstream.

src/ui/gossamer/README.adoc

• Note the new wasm-validate step in the status table.
• Document the manual browser smoke procedure (the DoD explicitly allows the browser load step to be a documented manual smoke until CI produces an artifact).
• Cross-link hyperpolymath/ephapax#36.

DoD checklist (from #196)

• Workflow's "Attempt to compile bridge.eph" step succeeds — gated on ephapax#36
• wasm-validate passes on the produced artifact — wired, runs when compile succeeds
• loader.js TODOs resolved — wasi_snapshot_preview1 stub replaced; string ABI documented + bounds-checked
• index.html browser smoke — documented as manual step per DoD

Test plan

• CI: confirm the Build Gossamer GUI workflow still passes (compile step continues to skip with the existing warning; wasm-validate + Install wabt steps stay un-evaluated until compile succeeds, per the if: guards).
• After ephapax#36 lands and the workflow promotes the compile step: confirm wasm-validate runs and the artifact uploads.
• Manual: place a real hypatia_gui.wasm under src/ui/public/assets/wasm/, serve src/ui/public/, and confirm index.html loads without console errors against a running Hypatia OTP listener on :9090.

---

Generated by Claude Code

[hyperpolymath]

Landing summary

This PR is the prep landing for #196. The single remaining DoD bullet ("compile step succeeds, produces hypatia_gui.wasm") stays blocked on hyperpolymath/ephapax#36; everything that can be done from the hypatia side has landed here.

What shipped

Commit	Change
b0abfe3	Added wasm-validate to the workflow (gated on compile success); replaced wasi_snapshot_preview1 stub in loader.js with a gossamer host-imports namespace mirroring bridge.eph's extern "gossamer" block; bounds-checked readString; documented manual browser smoke procedure
1c0e3e9	Bumped taiki-e/install-action SHA to v2.77.5 (old v2.51.11 SHA no longer resolvable) for this workflow only
3b85550	Made "Verify Ephapax CLI" step tolerant of upstream binary naming — discovers whatever cargo built and exports EPHAPAX_CLI for downstream steps

CI state

All red checks on this PR are pre-existing main-branch failures (same set was red on #211 when it merged) — Rust deny/clippy/format, Haskell HLint/audit/SBOM, Container Trivy variants, A2ML/K9 manifest validators, antipattern Check for TypeScript (exit 127), Build Test Images, etc. None touch this PR's diff (one workflow YAML, one JS file, one adoc).

The workflow this PR does modify (Build Gossamer GUI) now:

• gets past "Set up job" (SHA fix),
• tolerantly discovers the Ephapax CLI binary,
• still skips the actual compile with a ::warning:: until ephapax#36 lands — but auto-promotes the moment it does.

Follow-ups filed

• Bump taiki-e/install-action SHA in remaining 4 workflows #214 — bump the same taiki-e/install-action SHA in the other 4 workflows
• Verify Ephapax string ABI against real .wasm output #215 — verify the Ephapax string ABI against a real wasm artifact once one exists
• Manual browser smoke test of Hypatia GUI wasm artifact #216 — execute the manual browser smoke procedure once CI publishes an artifact

Recommendation

• Merge this PR.
• Keep Enable end-to-end .eph -> .wasm compile in build-gossamer-gui #196 open until ephapax#36 lands and the workflow auto-promotes — the literal DoD ("compile step succeeds, not skipped") can't be true until then. At that point, only Manual browser smoke test of Hypatia GUI wasm artifact #216's manual smoke is left for Enable end-to-end .eph -> .wasm compile in build-gossamer-gui #196 to close.

---

Generated by Claude Code