Harden load/compile pipeline, generated bindings, and eq install

[undivisible]

Summary

Implements the high-severity SAFE subset from the burn audit:

1. Honest load() / compile_to_c

   • C compiles to a PIC object (-c -fPIC), not preprocessor output.
   • Output path uses the language-correct artifact (.o / .a / .c).
   • Compiler success requires the artifact to exist; sibling .h is copied for bindings.
   • LoadOptions.compile / link are honored. Binding errors surface as LoadError::BindingFailed.
   • Extra compile_args / link_args are validated (no -fplugin, @response, output overrides, -Wl).
   • demo-app and full-demo now use cc + generate_bindings + include! and actually link.

2. Polyglot TUI

   • Removed the dead constellation animation (~190 lines) that referenced undefined types, so polyglot.rs typechecks.

3. Compiler argv / find_compiler

   • Zig: -fPIC -OReleaseFast. Nim: nimcache under the output dir, --app:staticlib --noMain --mm:none --passC:-fPIC. Odin: -file -reloc-mode:pic. C/C++/D: PIC.
   • Per-language version_args (version vs --version). Resolved compiler_path is stored. C# also probes dotnet.
   • compile_batch maps thread panics to CompileError instead of unwrap.

4. Generated Rust hardening

   • Identifiers must match ^[A-Za-z_][A-Za-z0-9_]*$; enum discriminants are integer literals only.
   • Unknown C types are not interpolated raw. Pointers require a known pointee for ABI-safe imports.

5. eq install

   • Exact match on id/bin (plus explicit C# aliases). eq install c no longer installs C#.
   • Sudo requires TTY confirmation (EQ_INSTALL_YES=1 to opt in; EQ_INSTALL_NO_SUDO=1 still skips system PMs).
   • Installs run sequentially. Windows uses Command.current_dir(TEMP) instead of process-global set_current_dir. Winget gets non-interactive accept flags.

Follow-ups (not in this PR)

• Replace the line C parser with bindgen/libclang.
• Helper-crate {.ffi.} / @ffi honesty and rust-ffi null checks.
• Docs/CI hygiene (bindings.code, fmt gate, lockfile, dashboard.html).
• Polyglot TUI still path-depends on sibling crepuscularity-tui (clone-alone).
• Compiler timeout / scan_directory symlink cycles.

Test plan

• cargo test --all-features
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt -- --check
• cargo build demo-app and full-demo; ran both binaries

---

Note

Medium Risk
Changes compiler invocation, generated code emission, and privileged package installs; mistakes could break builds or block installs, but the intent is to reduce injection and unsafe FFI generation.

Overview
Hardens the FFI toolchain after a security audit: compile/load now emits real PIC objects (not C preprocessor output), picks language-appropriate artifacts, requires outputs to exist, copies sibling headers for bindings, honors LoadOptions.compile / link, validates extra compile/link flags, and emits Cargo link instructions when appropriate. Binding generation failures propagate as errors instead of being swallowed.

Generated Rust from headers is stricter: valid C identifiers only, integer-only enum discriminants (blocks injection like include! in discriminants), checked type mapping (no raw passthrough of unknown types), and tighter ABI-safe import rules.

eq install gains exact compiler matching (including C# aliases, hint when c is mistaken for C#), interactive confirmation before sudo (with EQ_INSTALL_YES / non-TTY refusal), sequential installs, non-interactive winget flags, and Windows UNC cwd handling via Command.current_dir instead of mutating the process cwd.

Examples (demo-app, full-demo) compile C with cc, call generate_bindings, and include! generated bindings so demos actually link. Polyglot GUI drops ~190 lines of broken constellation animation so polyglot.rs typechecks. Compiler detection stores resolved compiler_path, uses per-language version argv, and updates Zig/Nim/Odin/C compile invocations (PIC, nimcache, staticlib, etc.).

^{Reviewed by Cursor Bugbot for commit 97c6553. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_dd5e858c-9db1-4008-b2cc-92d497687118)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[undivisible]

Rebased onto current `main` and omitted `-fPIC` (and Nim/D/Odin PIC equivalents) on Windows so MSVC clang can compile C objects. Unix still passes PIC flags.

Local: `cargo test --all-features`, clippy `-D warnings`, demo-app and full-demo binaries ran successfully.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b7b45ae4-3909-49ef-8e99-7d4d3fa41e59)