chore: Stapeln setup, TS→Zig test port, container + CI hardening

- Fix stapeln.toml: broken TOML entrypoint, Node.js references, wrong
  Containerfile path → now points to container/Containerfile and uses
  Zig layer definitions (ffi-build, adapter-build, runtime)
- Fix container/Containerfile: resolve V-lang merge conflict header;
  clean SPDX header and correct Zig build comment throughout
- Fix root Containerfile: replace node:22-slim with
  cgr.dev/chainguard/node:latest (Chainguard compliance); add WASM
  transition notice
- Kill all 7 TypeScript test files (zero-tolerance policy):
  tests/{smoke,e2e_mcp,aspect_security,p2p_cartridge_properties,mcp_bench}.ts
  cartridges/local-coord-mcp/tests/e2e_coord.ts
  Replace with equivalent Zig tests; all pass under zig test.
  e2e_coord.zig skips gracefully when adapter binary not yet built.
- Wire new Zig protocol tests into ffi/zig/build.zig under
  `protocol-tests` step; all included in `test` step.
- Fix npm-bun-blocker.yml: was root-only; now recursively checks for
  package-lock.json, bun.lockb, node_modules/, .npmrc anywhere in tree.
  Correctly surfaces mcp-bridge/package-lock.json violation.
- Fix ts-blocker.yml: was new-additions-only; now zero-tolerance for
  any existing .ts/.tsx files in the tree.
- Drop deno.lock: no longer needed (TS files removed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/npm-bun-blocker.yml

@@ -12,10 +12,33 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Block npm/bun
+      - name: Block npm/bun (recursive)
         run: |
-          if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
-            echo "❌ npm/bun artifacts detected. Use Deno instead."
-            exit 1
+          LOCKFILES=$(find . -name "package-lock.json" -not -path "./.git/*" -not -path "*/node_modules/*" 2>/dev/null || true)
+          BUN_LOCK=$(find . -name "bun.lockb" -not -path "./.git/*" 2>/dev/null || true)
+          NODE_MODS=$(find . -name "node_modules" -type d -not -path "./.git/*" 2>/dev/null || true)
+          NPMRC=$(find . -name ".npmrc" -not -path "./.git/*" 2>/dev/null || true)
+
+          FAIL=0
+          if [ -n "$LOCKFILES" ]; then
+            echo "❌ package-lock.json detected (use Deno instead of npm):"
+            printf '%s\n' "$LOCKFILES"
+            FAIL=1
+          fi
+          if [ -n "$BUN_LOCK" ]; then
+            echo "❌ bun.lockb detected (banned):"
+            printf '%s\n' "$BUN_LOCK"
+            FAIL=1
+          fi
+          if [ -n "$NODE_MODS" ]; then
+            echo "❌ node_modules/ detected (no runtime npm install):"
+            printf '%s\n' "$NODE_MODS"
+            FAIL=1
+          fi
+          if [ -n "$NPMRC" ]; then
+            echo "❌ .npmrc detected:"
+            printf '%s\n' "$NPMRC"
+            FAIL=1
           fi
+          if [ "$FAIL" -eq 1 ]; then exit 1; fi
           echo "✅ No npm/bun violations"

.github/workflows/ts-blocker.yml

@@ -12,15 +12,22 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Block new TypeScript/JavaScript
+      - name: Block TypeScript (zero tolerance) and new JavaScript
         run: |
-          NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
-          NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
+          # Zero-tolerance: NO .ts files anywhere in the tree.
+          EXISTING_TS=$(find . -name "*.ts" -o -name "*.tsx" | grep -v './.git/' | grep -v node_modules | grep -v '\.gen\.' || true)
+          if [ -n "$EXISTING_TS" ]; then
+            echo "❌ TypeScript files found (must be zero — port to Zig or ReScript):"
+            printf '%s\n' "$EXISTING_TS"
+            exit 1
+          fi
 
-          if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
-            echo "❌ New TS/JS files detected. Use ReScript instead."
-            [ -n "$NEW_TS" ] && echo "$NEW_TS"
-            [ -n "$NEW_JS" ] && echo "$NEW_JS"
+          # JS: block new additions only (existing JS tracked for WASM migration).
+          NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
+          if [ -n "$NEW_JS" ]; then
+            echo "❌ New .js files detected. Target language is Zig→WASM; use Zig or ReScript instead."
+            printf '%s\n' "$NEW_JS"
             exit 1
           fi
-          echo "✅ ReScript policy enforced"
+
+          echo "✅ No TS/new-JS violations"

Containerfile

@@ -1,17 +1,20 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Lightweight MCP stdio bridge for inspection and deployment.
-# Runs only the Node.js MCP bridge (zero dependencies).
+# Lightweight MCP stdio bridge for inspection and local development.
+# Runs only the Node.js MCP bridge (zero npm dependencies).
 # The bridge responds to MCP initialize + tools/list with the full
 # cartridge tool manifest.
 #
-# For the full production image with Zig FFI + V adapter, use:
+# TRANSITIONAL: this image will be replaced by a Zig→WASM bridge once
+# typed-wasm-mcp lands. See docs/architecture/TYPED-WASM-MCP-BRIDGE.md.
+#
+# For the full production image (Zig FFI + adapter), use:
 #   podman build -f container/Containerfile .
 #
 # Usage:
 #   podman build -t boj-server:latest .
 #   echo '{"jsonrpc":"2.0","id":1,"method":"initialize",...}' | podman run -i boj-server
 
-FROM node:22-slim
+FROM cgr.dev/chainguard/node:latest
 
 LABEL org.opencontainers.image.title="Bundle of Joy Server (MCP Bridge)" \
       org.opencontainers.image.description="MCP stdio transport for BoJ cartridge toolkit" \