feat: vendor real eclipse-score rust_kvs + verify gate that runs bazel tests

Replaces the toy 80-line in-memory KVS with the actual eclipse-score
rust_kvs sources (Apache-2.0, vendored verbatim at vendor/rust_kvs/)
plus a tiny no-op shim for score_log/baselibs_rust at
vendor/score_log_shim/. The vendored crate compiles natively under
bazel rust_library and runs all 244 of its upstream unit tests via
bazel rust_test.

tools/verify.py is no longer a stub. It reads each comp-req artifact's
new `verified-by:` list (`<bazel-target>:<test-fn-name>` entries),
discovers tests via the bazel target binary's --list, then invokes
`bazel test --test_arg=--exact --test_arg=<name>` per entry. PASSED /
FAILED / MISSING reflects real bazel-test outcomes.

Adds tests/surface/surface_tests.rs — one #[test] per comp-req that
asserts the upstream's verbatim RST text against the vendored impl.
Honest finding (clean-room-verified across both Rust and C++ sources):
comp_req__kvs__key_naming (alphabet [A-Za-z0-9_-]) and
comp_req__kvs__key_length (32-byte cap) are documented but unenforced
and untested. The gate goes red on those two comp-reqs; that's the
LS-N demonstration vs. coverage-wedge reporting.

CI collapses into a single job that installs bazelisk, runs rivet
validate, bazel build, and make verify.

Final gate output: 4 PASSED, 2 FAILED, 0 MISSING.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

.cargo-shim/lib.rs

@@ -0,0 +1,4 @@
+// Empty stub so cargo doesn't try to compile src/lib.rs (which depends
+// on Bazel-generated `kvs_component_bindings` and cannot be built by
+// plain cargo). The cargo-shim crate only exists for crate_universe's
+// external-dep resolution; see /Cargo.toml header.

.github/workflows/validate.yml

@@ -1,9 +1,15 @@
-# example-kvs CI — runs the two gates that work without spar/sigil
-# installed: rivet validate (typed-artifact graph check) and the
-# artifact-driven verification gate (tools/verify.py).
+# example-kvs CI — single job that runs the three gates:
+#   1. `rivet validate`   typed-artifact graph check
+#   2. `bazel build //...` AADL → WIT → wit-bindgen → WASM component
+#   3. `python tools/verify.py` artifact-driven verification gate
+#      (drives bazel test per comp-req's verified-by entries)
 #
-# No untrusted input is used in any run: block; all commands are
-# static make targets / pinned installs.
+# Note: CI may go RED on purpose. The verify gate runs surface tests
+# against the vendored eclipse-score rust_kvs sources. Some of those
+# tests assert spec compliance the upstream impl does not enforce;
+# when that's the case, the test FAILs and the gate FIREs. That is
+# the LS-N demonstration vs. "green-CI-by-default" coverage-wedge
+# reporting. See README.md "What this gate measures" for details.
 
 name: validate
 
@@ -18,8 +24,8 @@ permissions:
   contents: read
 
 jobs:
-  validate-pinned:
-    name: rivet validate + artifact-driven verification gate
+  validate:
+    name: rivet + bazel + verify
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -34,25 +40,19 @@ jobs:
       - name: Install PyYAML for verify.py
         run: pip install pyyaml
 
-      - name: rivet validate (typed-artifact graph check)
-        run: make validate
-
-      - name: artifact-driven verification gate
-        run: make verify
-
-  bazel-wasm-component:
-    name: bazel build (AADL → WIT → wasm component)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
       - name: Set up bazelisk
         uses: bazel-contrib/setup-bazel@0.9.1
         with:
           bazelisk-version: "1.x"
 
-      - name: bazel build //... (WIT → wit-bindgen → rust_component → .wasm)
+      - name: rivet validate (typed-artifact graph check)
+        run: make validate
+
+      - name: bazel build (AADL → WIT → wit-bindgen → wasm component)
         run: bazel build //...
 
-      - name: bazel test //... (rust_wasm_component_test)
-        run: bazel test //... --test_output=errors
+      - name: artifact-driven verification gate (real bazel test per artifact)
+        # verify.py shells out to `bazel test --test_arg=--exact …` per
+        # entry in each comp-req's verified-by list. Honest signal: red
+        # iff any comp-req has FAILED or MISSING evidence.
+        run: make verify