fix(nwsync): pin emitter version, ship the shim, harden manifest reads

Review follow-ups on the same work:

- emitter_version is its own sidecar field, not the build revision. Keying
  the merge check on created_with invalidated every published index on every
  unrelated crucible commit, forcing a re-emit of the whole corpus.
- flake.nix builds cmd/crucible-nwsync, so Nix consumers get the binary the
  docs promise.
- readManifest uses io.ReadFull: bytes.Reader.Read can return a short count
  with no error, so a truncated manifest parsed into zero-padded garbage.
- emit refuses a .mod outright and names why, rather than failing on an
  unknown extension.
- SOURCE_DATE_EPOCH pins the sidecar timestamp; the manifest was already
  deterministic.
- Entry.identity replaces the resref/restype key struct duplicated in emit
  and assemble.

Refs #53.

internal/nwsync/manifest.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -36,6 +37,15 @@ type Entry struct {
 
 func (e Entry) sha1Hex() string { return hex.EncodeToString(e.SHA1[:]) }
 
+// Identity is what a resref resolves by: name plus type. It is the merge key
+// inside one artifact and across artifacts alike.
+type Identity struct {
+	ResRef  string
+	ResType uint16
+}
+
+func (e Entry) identity() Identity { return Identity{ResRef: e.ResRef, ResType: e.ResType} }
+
 // writeManifest serialises entries into NSYM v3 bytes.
 func writeManifest(entries []Entry) ([]byte, error) {
 	sorted := make([]Entry, len(entries))
@@ -86,7 +96,7 @@ func writeManifest(entries []Entry) ([]byte, error) {
 func readManifest(data []byte) ([]Entry, error) {
 	reader := bytes.NewReader(data)
 	magic := make([]byte, 4)
-	if _, err := reader.Read(magic); err != nil || string(magic) != "NSYM" {
+	if _, err := io.ReadFull(reader, magic); err != nil || string(magic) != "NSYM" {
 		return nil, fmt.Errorf("not a manifest (invalid magic bytes)")
 	}
 	var version, entryCount, mappingCount uint32
@@ -102,7 +112,7 @@ func readManifest(data []byte) ([]Entry, error) {
 	entries := make([]Entry, 0, entryCount+mappingCount)
 	for i := uint32(0); i < entryCount; i++ {
 		var entry Entry
-		if _, err := reader.Read(entry.SHA1[:]); err != nil {
+		if _, err := io.ReadFull(reader, entry.SHA1[:]); err != nil {
 			return nil, fmt.Errorf("truncated entry %d: %w", i, err)
 		}
 		if err := binary.Read(reader, binary.LittleEndian, &entry.Size); err != nil {
@@ -135,7 +145,7 @@ func readManifest(data []byte) ([]Entry, error) {
 
 func readResRef(reader *bytes.Reader) (string, uint16, error) {
 	raw := make([]byte, resRefBytes)
-	if _, err := reader.Read(raw); err != nil {
+	if _, err := io.ReadFull(reader, raw); err != nil {
 		return "", 0, err
 	}
 	var restype uint16
@@ -171,6 +181,7 @@ type Sidecar struct {
 	OnDiskBytes            int64  `json:"on_disk_bytes"`
 	Created                int64  `json:"created"`
 	CreatedWith            string `json:"created_with"`
+	EmitterVersion         string `json:"emitter_version,omitempty"`
 	GroupID                int    `json:"group_id,omitempty"`
 }