feat(toolchain): add devenv-cli source resolver tool (RIG-2546)

[rigel-mintaka]

Build tools/toolchain/devenv-cli/, the single place that resolves the devenv
CLI source from a named devenv.lock. Parity-gate shape: pure resolution in
core.ts (lock JSON -> validated owner/repo/rev -> github:<owner>/<repo>/<rev>#devenv
flakeref; argv -> parsed request), a thin exec shell in index.ts, unit tests in
core.test.ts.

Two modes: --mode flakeref prints the flakeref (pure, no build/network) for
the caller to nix run; --mode bin-dir runs nix build --no-link --print-out-paths and exposes a single-devenv-symlink shim dir (RD-3: never
the raw closure bin dir, which could shadow the parity-pinned toolchain on
PATH). devenvSource() ignores the dir field some locks carry (the #devenv
flake attribute is selected, not a source subdir) and throws loudly on missing
node / non-github type / non-40-hex rev, the same fail-loud posture as
refresh-devenv-nixpkgs.core.ts.

This is RIG-2546 T1, the prerequisite tool; T2/T3 rewire renovate.yml and
ci.yml onto it. Register the project in .moon/workspace.yml (explicit map, no
glob). Dependency-free (bun/node builtins + ./core only, enforced by a static
import-hygiene test).

Verified: moon run devenv-cli:ci green (17 tests), tsc clean, biome clean;
smoke-tested against both real locks (root -> cachix flakeref, agent-image ->
RigelBuild fork flakeref) and error paths (missing lock / bad mode exit 1).

Spec-impact: none

Co-authored-by: Matt Wilkinson matt@rigel.build

---

Review disposition (self-review loop — sole review of record)

Two-round review loop (Opus, every lens), all findings dispositioned:

• Round 1 — 0 high / 2 medium / 3 low. All fixed:
  • M1 (index.ts): nix build swallowed nix's stderr in bin-dir — added stdio: ['ignore','pipe','inherit'] so the real build diagnostic streams through; stdout stays piped for the out-path capture.
  • M2 (core.ts): owner/repo were only non-empty-checked while rev is strict-hex — added charset guards (owner /^[A-Za-z0-9-]+$/, repo /^[A-Za-z0-9._-]+$/) to close a flakeref-reshaping surface (/, #, ?, whitespace). Not shell-injectable (arg-array exec), but could redirect the fetch / defeat the #devenv attr selection.
  • L1 (core.test.ts): added missing-owner, missing-repo, and charset (owner: "a/b#x") throw tests.
  • L2 (core.test.ts): broadened the import-hygiene property from static-import-only to also catch side-effect + dynamic import()/require().
  • L3 (index.ts): documented that the shim tempdir is intentionally never removed (caller appends to $GITHUB_PATH, needed post-exit).
• Round 2 — 0 high / 0 medium / 1 low (floor clear = all-clear). All 5 fixes verified correct; both real locks (cachix/devenv, RigelBuild/devenv) confirmed to still resolve under the M2 guards; no regression. The one low (hygiene scan omitted the export … from re-export form) fixed post-all-clear (added a fourth regex; verified live it catches export */{}/type re-exports).

Verified: moon run devenv-cli:ci green (20 tests / 26 expect), tsc + biome clean, M2 red-green confirmed. No finding deferred.

[linear-code]

RIG-2546

RIG-2809

[github-actions]

Compass engineering docs preview: https://dependencies-rig-2809-devenv.compass-eng-docs.pages.dev

Deployed from dependencies/rig-2809-devenv-cli at b6e5582.