build: implement --builder host (skip docker, use ./gradlew)

Adds realHostRunner: runs the source tree's ./gradlew wrapper
natively on the host, no eclipse-temurin container. Selected by
`trond build --builder host` (or `build.builder: host` in intent);
previously stubbed with "not implemented in Phase 1".

Key design points:

  - Builder identity: hashes `java -version` output as
    BuilderImageDigest so the cache invalidates when the host's
    JDK changes. The ref shows up as `host:openjdk version "..."`
    in `trond build list` tables for visual distinction from
    pinned docker refs.

  - resolveBuild bypasses pins.Resolve when Builder=host — host
    builds work with any JDK version, not just the ones with
    pinned eclipse-temurin images. (Pre-fix, --builder host
    with --jdk 99 would fail at pin lookup, never reaching the
    runner.)

  - findLargestFatJAR walks build/libs/ subdirs picking the
    largest matching JAR, mirroring the docker runner's
    `find ... | xargs ls -S | head -n1` so the two builders
    agree on which fat jar to promote out of a multi-module
    gradle layout.

  - For image artifacts, snapshots `docker images` host-side
    before/after gradle so image.go's diff logic still works
    unchanged. No docker.sock bind-mount needed (we're on the
    host already).

  - Refuses to run if the source tree has no ./gradlew so we
    don't silently fall back to the host's PATH `gradle`, which
    would break the "version pinned by source" guarantee.

Interface rename for clarity: internal dockerRunner →
buildRunner, RunDockerBuild → RunBuild. The exported TestRunner
API keeps its historical RunDockerBuild method name (adapter
bridges); existing test fakes were updated to the new internal
method name.

Smoke-tested against real java-tron source on macOS arm64 + JDK
17.0.15: ./gradlew help completed in 4.2s, manifest correctly
records `builder: host` + `builder_image: host:openjdk version
"17.0.15" ...`. Bad-task path returns the same structured
BUILD_FAILED envelope as the docker path.

Tests: 5 new (TestResolveHostIdentity, TestFindLargestFatJAR,
TestFindLargestFatJAR_NoMatches, TestHostRunner_RequiresGradlew,
TestResolveBuild_HostBuilderSkipsPins). Test that touches
`java -version` skips when no JDK is on PATH so CI without a JVM
isn't blocked.

Author: barbatos2011

internal/build/builder.go

@@ -218,25 +218,44 @@ func resolveBuild(ctx context.Context, req Request) (*resolved, error) {
 		return nil, err
 	}
 
-	imageRef, imageDigest, ok := pins.Resolve(req.JDKVersion, req.Platform, req.BuilderImageOverride)
-	if !ok {
-		platforms := pins.Platforms(req.JDKVersion)
-		if len(platforms) == 0 {
+	// Builder identity: for docker we resolve the pinned eclipse-
+	// temurin image; for host we hash the host's `java -version`
+	// output. Either way the result feeds CacheKey.BuilderImageDigest
+	// so the cache invalidates when the toolchain changes.
+	var imageRef, imageDigest string
+	if req.Builder == "host" {
+		var err error
+		imageRef, imageDigest, err = resolveHostIdentity(ctx)
+		if err != nil {
 			return nil, output.NewErrorf("VALIDATION_ERROR", output.ExitValidationError,
-				"no pinned builder image for JDK version %q (available: %v)",
-				req.JDKVersion, pins.Versions()).
+				"resolve host builder identity: %s", err.Error()).
 				WithSuggestions(
-					"Use one of "+strings.Join(pins.Versions(), ", "),
+					"Verify 'java' is installed and on PATH",
+					"Or use --builder docker to skip the host JDK requirement",
+				)
+		}
+	} else {
+		var ok bool
+		imageRef, imageDigest, ok = pins.Resolve(req.JDKVersion, req.Platform, req.BuilderImageOverride)
+		if !ok {
+			platforms := pins.Platforms(req.JDKVersion)
+			if len(platforms) == 0 {
+				return nil, output.NewErrorf("VALIDATION_ERROR", output.ExitValidationError,
+					"no pinned builder image for JDK version %q (available: %v)",
+					req.JDKVersion, pins.Versions()).
+					WithSuggestions(
+						"Use one of "+strings.Join(pins.Versions(), ", "),
+						"Or pass --builder-image-override <ref@sha256:...>",
+					)
+			}
+			return nil, output.NewErrorf("VALIDATION_ERROR", output.ExitValidationError,
+				"JDK %q has no pinned builder image for platform %q (supported: %v)",
+				req.JDKVersion, req.Platform, platforms).
+				WithSuggestions(
+					"Use one of platforms "+strings.Join(platforms, ", "),
 					"Or pass --builder-image-override <ref@sha256:...>",
 				)
 		}
-		return nil, output.NewErrorf("VALIDATION_ERROR", output.ExitValidationError,
-			"JDK %q has no pinned builder image for platform %q (supported: %v)",
-			req.JDKVersion, req.Platform, platforms).
-			WithSuggestions(
-				"Use one of platforms "+strings.Join(platforms, ", "),
-				"Or pass --builder-image-override <ref@sha256:...>",
-			)
 	}
 
 	src := Source{Path: req.SourcePath, RevisionSpec: req.RevisionSpec}
@@ -280,7 +299,7 @@ func buildJAR(ctx context.Context, r *resolved, started time.Time) (*Manifest, e
 
 	_ = os.Remove(outTmp) // stale .tmp from a prior cancelled run
 
-	runErr := defaultRunner.RunDockerBuild(ctx, r, outDir, outTmp)
+	runErr := defaultRunner.RunBuild(ctx, r, outDir, outTmp)
 	if runErr != nil {
 		_ = os.Remove(outTmp)
 		if errors.Is(ctx.Err(), context.Canceled) {

internal/build/builder_test.go

@@ -26,7 +26,7 @@ type recordingRunner struct {
 	respectCancel  bool
 }
 
-func (r *recordingRunner) RunDockerBuild(ctx context.Context, res *resolved, outDir, outTmp string) error {
+func (r *recordingRunner) RunBuild(ctx context.Context, res *resolved, outDir, outTmp string) error {
 	r.called = true
 	r.resolved = res
 	r.outTmp = outTmp
@@ -52,7 +52,7 @@ func (r *recordingRunner) RunDockerBuild(ctx context.Context, res *resolved, out
 // withMockRunner swaps the package-level defaultRunner for the
 // duration of one test. Restoration is registered via t.Cleanup so
 // parallel-safe across the suite.
-func withMockRunner(t *testing.T, mock dockerRunner) {
+func withMockRunner(t *testing.T, mock buildRunner) {
 	t.Helper()
 	orig := defaultRunner
 	defaultRunner = mock
@@ -317,7 +317,7 @@ type capturingRunner struct {
 	cb func(*resolved)
 }
 
-func (c *capturingRunner) RunDockerBuild(ctx context.Context, r *resolved, outDir, outTmp string) error {
+func (c *capturingRunner) RunBuild(ctx context.Context, r *resolved, outDir, outTmp string) error {
 	c.cb(r)
 	// Return error so Run cleans up and exits — caller doesn't care
 	// about the result, only the captured resolved.

internal/build/image.go

@@ -65,7 +65,7 @@ func buildImage(ctx context.Context, r *resolved, started time.Time) (*Manifest,
 		_ = os.Remove(filepath.Join(outDir, r.cacheKeyStr+"-images-after"))
 	}()
 
-	if err := defaultRunner.RunDockerBuild(ctx, r, outDir, "" /* outTmp unused for image */); err != nil {
+	if err := defaultRunner.RunBuild(ctx, r, outDir, "" /* outTmp unused for image */); err != nil {
 		if errors.Is(ctx.Err(), context.Canceled) {
 			return nil, output.NewErrorf("BUILD_CANCELLED", 130,
 				"build cancelled by user").

internal/build/runner.go

@@ -2,27 +2,30 @@ package build
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 )
 
-// dockerRunner abstracts the "run a docker command" step so tests can
-// substitute a recorder/mock without spinning up a real Docker
-// daemon. Production wiring is the exec-based realDockerRunner.
+// buildRunner abstracts the "run gradle to produce the artifact"
+// step so tests can substitute a recorder/mock without spinning up
+// a real Docker daemon (or a real gradle install for host-builder
+// tests). Production has two implementations: realDockerRunner runs
+// gradle inside a pinned eclipse-temurin container; realHostRunner
+// runs it directly via the source tree's ./gradlew wrapper.
 //
 // The interface intentionally accepts the full argv (not pieces) —
 // tests assert on that argv to enforce FR-022's argv-only invocation
 // contract (no `bash -c "...interpolated..."`).
-type dockerRunner interface {
-	RunDockerBuild(ctx context.Context, r *resolved, outDir, outTmp string) error
+type buildRunner interface {
+	RunBuild(ctx context.Context, r *resolved, outDir, outTmp string) error
 }
 
 // defaultRunner is package-level so tests can swap it via
 // `t.Cleanup(func() { defaultRunner = orig })`. Production uses
-// realDockerRunner which shells out to the docker CLI.
-var defaultRunner dockerRunner = realDockerRunner{}
+// dispatchRunner which routes to realDockerRunner or realHostRunner
+// based on r.req.Builder ("docker" or "host").
+var defaultRunner buildRunner = dispatchRunner{}
 
 // dockerBuildScript (JAR variant) is the only piece of shell trond
 // runs for artifact=jar and it's a compile-time constant. User input
@@ -84,13 +87,24 @@ docker images -q --no-trunc --filter dangling=false 2>/dev/null | sort -u > "/ou
 docker images -q --no-trunc --filter dangling=false 2>/dev/null | sort -u > "/out/$CACHE_KEY-images-after"
 `
 
-type realDockerRunner struct{}
+// dispatchRunner is the production buildRunner. It looks at
+// r.req.Builder and forwards to the docker or host variant. Pulling
+// the routing into its own type (rather than putting an `if Builder
+// == "host"` check inside realDockerRunner) keeps each concrete
+// runner single-purpose and lets tests substitute either backend
+// independently.
+type dispatchRunner struct{}
 
-func (realDockerRunner) RunDockerBuild(ctx context.Context, r *resolved, outDir, outTmp string) error {
+func (dispatchRunner) RunBuild(ctx context.Context, r *resolved, outDir, outTmp string) error {
 	if r.req.Builder == "host" {
-		return fmt.Errorf("--builder host not implemented in Phase 1 (use docker)")
+		return realHostRunner{}.RunBuild(ctx, r, outDir, outTmp)
 	}
+	return realDockerRunner{}.RunBuild(ctx, r, outDir, outTmp)
+}
+
+type realDockerRunner struct{}
 
+func (realDockerRunner) RunBuild(ctx context.Context, r *resolved, outDir, outTmp string) error {
 	// Gradle cache: use a DOCKER NAMED VOLUME, not a bind mount.
 	// macOS Docker Desktop's bind-mount layer (virtiofs) doesn't
 	// reliably preserve the exec bit for files the container writes