…e2e (#194)

## Why
#193 merged with E2E red — feedback invokes returned `{}`. I installed
Zig 0.15.2 (it's on **PyPI** — the sandbox blocks `ziglang.org` but not
PyPI) and traced it to root cause, locally, end-to-end.

**The `{}` was never my FFI code** (it compiles, 15/15 unit tests pass,
and the real `boj-invoke` CLI returns correct JSON). It was two infra
faults in one e2e step, plus an architectural fact:

1. **`boj-invoke` was never built** — the "Build FFI libraries" step ran
`zig build`, but the CLI the Elixir Invoker shells out to is only
produced by `zig build invoke`. No CLI → `:cli_missing` → `{}` for
*every* FFI tool invoke.
2. **Cartridge `.so`s were never built either** — after `cd ffi/zig`,
the `for cart in cartridges/*/ffi` loop globbed from the wrong
directory, matched nothing, and `|| true` hid it.
3. **The invoker is fork-per-request** (ADR-0005): each invoke is a
fresh process, so the cartridge's in-memory channel state does **not**
persist between HTTP calls. A multi-step `register → submit → stats`
cycle cannot span calls (proved: two separate submits both
`recorded:false`).

## What
- **`feedback_ffi.zig`** — `feedback_submit` is now
**self-provisioning**: when the slot isn't an active collecting channel
(the stateless case) it registers + starts collecting before recording,
so a lone submit returns `recorded:true` in one call. Within one process
(a pooled invoker, or the unit test) an already-collecting slot is
reused and counts still accumulate. Added a cold-start unit test →
**15/15 pass**.
- **`tests/e2e_full.sh`** Step 6 — assert only what a stateless invoker
can truthfully deliver: register returns a slot, each submit records,
`get_stats` returns the stats shape. Cross-call accumulation (the full
state machine) is left to the pooled-invoker follow-up and is covered by
the in-process Zig unit test.
- **`.github/workflows/e2e.yml`** — build `boj-invoke`; contain the `cd`
in a subshell so the cartridge loop globs from the repo root; tidy the
loop to an explicit `if` (silences SC2015).

## Verification (local, Zig 0.15.2 — CI's exact version)
```
zig build               # exit 0, libfeedback_mcp.so
zig test feedback_ffi   # All 15 tests passed
# real boj-invoke CLI (what the Invoker calls):
register → {"slot":0,"channel":2,"state":1}
submit   → {"recorded":true,"slot":0,"sentiment":1,"feedback_count":1}
stats    → {"slot":0,"total_feedback":0,...}   # truthfully per-call
```
The full Elixir server e2e needs `hex.pm` (blocked in this sandbox), but
`boj-invoke` is exactly what the Invoker shells out to, so the feedback
invoke path is fully covered. ABI is unchanged (dispatch body only) →
`abi-drift` stays green.

🤖 Draft via Claude Code.

---
_Generated by [Claude
Code](https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa)_

Co-authored-by: Claude <noreply@anthropic.com>