feat(toolchain): make opsm.toml [runtime] the single source of truth

[hyperpolymath]

Problem

OPSM had no single source of truth for its own toolchain versions — five sources disagreed:

Source	Erlang	Elixir	Notes
.tool-versions (what actually builds it)	28.3.1	1.19.5-otp-28	+ vestigial nodejs 25.6.1
opsm.toml [runtime] (read by opsm runtime install)	26.2.0	1.16.0	stale
.gitlab-ci.yml	elixir:latest	rust:latest	non-reproducible
e2e.yml + nif-build.yml	27.0	1.17	hardcoded
trust-pipeline-e2e.yml	26.2	1.16.0	hardcoded

Plus: Nickel heavily used (runtime/**/*.ncl) but pinned nowhere, Idris2 (a real build dep — src/abi/*.idr) unpinned, Rust floating on stable.

Fix

opsm.toml [runtime] is now canonical (dogfooding — opsm runtime install already consumes it). Everything else derives from it or is drift-checked against it:

opsm.toml [runtime]  ── just toolchain-sync ──►  .tool-versions ──► asdf/mise + setup-beam (version-file)
        └─ just toolchain-check (Mustfile-gated) ──► verifies .tool-versions + GitLab image pins

• opsm.toml: corrected stale pins (erlang → 28.3.1, elixir → 1.19.5-otp-28); completed the set (rust 1.97.0, nickel 1.16.0, idris2 0.8.0); dropped the vestigial nodejs pin (no package.json, nothing invokes node — Deno is the sole JS runtime)
• scripts/toolchain.sh (new, POSIX sh): sync regenerates .tool-versions; check fails loudly on any drift, incl. GitLab image tags. Wired as just toolchain-sync / just toolchain-check + Mustfile check
• .tool-versions: now generated, with idris2 (no asdf plugin — pack/Chez route) and rust (asdf-global, cargo-audit conflict) excluded via documented skip-list. zig/deno/nickel provision via the estate's asdf-tool-plugins
• GitLab CI: elixir:1.19.5-otp-28 + rust:1.97 (tags verified on Docker Hub); also fixed the invalid // comment on line 2 that broke YAML parsing. Scanner images (trivy/semgrep/trufflehog) deliberately float — fresh detection DBs beat cosmetic pinning
• GitHub workflows: setup-beam now reads .tool-versions (version-file + version-type: strict) in e2e, nif-build, and trust-pipeline-e2e; rust steps pin toolchain: 1.97.0 (nif-build, echidna-validation)
• parse_runtime_section/1 (manager.ex): hardened — comment lines containing = were mis-parsed as pins and inline comments corrupted versions; tests added
• docs/TOOLCHAIN.adoc (new): derivation chain, per-tool provisioner table, the honest bootstrap story (OPSM is an Elixir escript — it cannot provision the BEAM for itself; asdf/mise/Guix sit underneath), and the Idris2 route (pack + Chez + GMP today; guix.scm is still a stub, documented as TODO rather than overclaimed)

Verified

• sh scripts/toolchain.sh sync && sh scripts/toolchain.sh check → green
• Drift injections (.tool-versions version mutated; GitLab image reverted to :latest) → both exit 1
• All 5 edited YAML files parse cleanly
• Elixir parser tests not run locally (no BEAM in this container) — CI runs them; watching this PR for fallout, especially trust-pipeline-e2e moving 26.2 → 28.3.1 (accepted risk per owner decision)

Known follow-ups (out of scope here)

• guix.scm is a stub (source #f) — growing it into a real manifest is recorded in STATE.a2ml next-actions
• Handoff sections B/C (service deps wiring, solver stack) — separate work

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

---

Generated by Claude Code

[hyperpolymath]

CI status notes (after c002681):

1. The two E2E failures were Elixir 1.19 fallout, now fixed. Moving CI from Elixir 1.17 to the canonical 1.19.5-otp-28 surfaced 9 warnings under --warnings-as-errors that the older compiler never flagged. Two were real bugs, not type noise:

   • cleanup/2 dropped config/data/cache removal actions from its returned list (actions = actions ++ … rebound inside an if block, which doesn't escape Elixir scoping)
   • remove_systemd_units/1 always returned [] and never triggered daemon-reload (the for comprehension discarded its results)

   The rest were provably dead {:error, …} clauses on infallible callees, plus run/1 clause-grouping. Verified locally on OTP 28.3.1 / Elixir 1.19.5: mix compile --warnings-as-errors passes; 805 tests with 1 failure that is a sandbox-proxy artifact (a "no-network" test reaching api.github.com through the session proxy and getting 401), not reproducible on GitHub runners.

2. governance / Language / package anti-pattern policy is pre-existing, not from this PR. It fails identically on main at the base commit (run #94, head f91eb34) — 21 grandfathered .res files (cli/, lib/ocaml/, opsm_mobile/src/) from the estate ReScript→AffineScript migration. Declaring .hypatia-ignore exemptions is an owner-approval decision per estate policy, so this PR flags it rather than touching it.

---

Generated by Claude Code