Phase 5: scaffold Crucible (sow-tools) — dispatcher + builder shims, container, PR-first CI, fail-closed (D11, D19).

scripts/build-binaries.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Build every Crucible binary in cmd/ into ./bin.
+#
+# Replaces the old single-binary build-tool.sh. Outputs are gitignored — they
+# are CI artifacts / image layers, never committed (D19). The short git sha is
+# stamped into the version via -ldflags.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+sha="$(git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)"
+ldflags="-X gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${sha}"
+
+mkdir -p bin .cache/go-build
+export GOCACHE="${PWD}/.cache/go-build"
+
+for dir in ./cmd/*/; do
+  name="$(basename "$dir")"
+  echo "building ${name}"
+  go build -trimpath -ldflags "${ldflags}" -o "bin/${name}" "${dir}"
+done
+
+echo "built into ./bin: $(cd bin && echo *)"

scripts/crucible-smoke.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Smoke test the built Crucible binaries:
+#   - the dispatcher reports version + lists builders
+#   - every builder fails closed (exit 70) until it is wired (Phase 5 scaffold)
+#   - each standalone shim agrees with the dispatcher
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+bin=bin
+
+[[ -x "${bin}/crucible" ]] || { echo "no ${bin}/crucible — run scripts/build-binaries.sh first" >&2; exit 1; }
+
+"${bin}/crucible" version >/dev/null
+"${bin}/crucible" list >/dev/null
+
+builders=(depot hak module topdata wiki)
+for b in "${builders[@]}"; do
+  [[ -x "${bin}/crucible-${b}" ]] || { echo "missing ${bin}/crucible-${b}" >&2; exit 1; }
+
+  set +e
+  "${bin}/crucible" "${b}" >/dev/null 2>&1
+  via_dispatch=$?
+  "${bin}/crucible-${b}" >/dev/null 2>&1
+  via_shim=$?
+  set -e
+
+  if [[ "${via_dispatch}" -ne 70 ]]; then
+    echo "FAIL: crucible ${b} exit=${via_dispatch}, want 70 (unwired must fail closed)" >&2
+    exit 1
+  fi
+  if [[ "${via_shim}" -ne 70 ]]; then
+    echo "FAIL: crucible-${b} exit=${via_shim}, want 70 (must match dispatcher)" >&2
+    exit 1
+  fi
+done
+
+echo "smoke ok: dispatcher + ${#builders[@]} builders fail closed as expected"