feat: embed mint source for standalone binary

[waynesun09]

Summary

• Embeds internal/mint/ source files (go.mod, go.sum, main.go) into the fullsend binary at build time using go:embed
• bundleFunctionSource() falls back to the embedded copy when the filesystem path doesn't exist (e.g. running from a downloaded release binary)
• Logs a warning when local mint source is used instead of the embedded version, so users know they're picking up local files
• Adds a drift-detection test (TestEmbeddedMintSource_MatchesOriginal) that fails if the embedded copies diverge from the originals in internal/mint/

Problem: Running fullsend admin install from a release binary fails with open internal/mint: no such file or directory because the default source path only exists inside the repo checkout.

Approach: Files are stored with .embed suffix in mintsrc/ to avoid Go treating the directory as a separate module (since internal/mint/ has its own go.mod for Cloud Function deployment).

Test plan

• go test ./internal/dispatch/gcf/ — all tests pass
• go vet ./internal/dispatch/gcf/ — clean
• go build ./cmd/fullsend/ — binary builds with embedded source (~34 KB larger)
• Run binary from outside repo directory — should use embedded mint source without errors
• Run binary from repo root — should log warning about using local source

[github-actions]

Site preview

Preview: https://76eb70a9-site.fullsend-ai.workers.dev

Commit: 581a1c1a370a56fa3ff86272ed6439ed1cafe8fe

[fullsend-ai-review]

Review

No findings.

Previous run

Review

Findings

Low

• [docs-currency] docs/guides/admin/installation.md:86 — The guidance "Use --skip-mint-deploy when running from a machine without the function source code" is stale. With the embedded fallback, the binary always has mint source available. This sentence should be revised or removed to avoid suggesting users add an unnecessary flag.

• [docs-currency] docs/ADRs/0033-per-repo-installation-mode.md:260 — The --skip-mint-deploy and --mint-source-dir flag descriptions don't mention the embedded source fallback. Consider adding a note that --mint-source-dir is only needed to override the embedded copy with local files.

Info

• [resolved] internal/dispatch/gcf/provisioner.go — Prior medium finding (non-deterministic map iteration in bundleEmbeddedMintSource) has been resolved. Keys are now sorted before iteration, ensuring deterministic zip hashing.

Previous run (2)

Review

Findings

Medium

• [correctness] internal/dispatch/gcf/provisioner.go:1293 — bundleEmbeddedMintSource iterates over embeddedMintFiles (a Go map), producing non-deterministic file order in the zip archive. Since needsCodeDeploy compares sha256Hex(sourceZip) against the deployed hash, each invocation from a release binary may compute a different hash for identical content, triggering an unnecessary Cloud Function redeployment every time fullsend admin install runs.
  Remediation: Sort the map keys before iterating, matching the deterministic ordering that os.ReadDir provides in the filesystem path. For example: collect keys into a slice, sort.Strings(keys), then iterate the slice.

Low

• [docs-currency] docs/guides/admin/installation.md:86 — The guidance "Use --skip-mint-deploy when running from a machine without the function source code" is now stale. With the embedded fallback, the binary deploys the mint source automatically when the filesystem path is absent. This sentence should be updated or removed to avoid confusing users into adding an unnecessary flag.

[waynesun09]

/fs-review