deploy_dashboard_srv1 E2BIG on every main push: emitted deploy fold spawns sh with whole script as one argv (grew past MAX_ARG_STRLEN with roadmap content); root fix = reference checked-out artifacts instead of embedding (dag/gunbc/live_deploy/emit.dag; first failure run 29468603049)

dag/extdeps/shell/shell.dag

@@ -204,7 +204,10 @@ service shell.Exec {
       stderr: String from "stderr"
     }
 
-    transport shell { argv: ["sh", "-c", "{script}"] }
+    transport shell {
+      argv: ["sh", "-s"]
+      stdin: script
+    }
     exit {
       0 => Unit
       nonzero => String "Script failed"

dag/test/claim/shell_exec_run_argv_embed_witness_test.dag

@@ -0,0 +1,34 @@
+module test.claim.shell_exec_run_argv_embed_witness
+
+import std.types { Bool, String }
+import std.measure { ByteSize, byte_size, byte_size_count }
+import gunbc.live_deploy.emit { live_deploy_apply_script_for }
+import gunbc.live_deploy.spec { deployment_spec_srv1 }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+data shell_dag_path: String = "dag/extdeps/shell/shell.dag"
+
+data local_argv_embed_budget: ByteSize = byte_size(65536)
+
+fn src_has(path: String, needle: String) -> Bool {
+  let r = filesystem_read(path: path)
+  string_contains(s: r.content, pattern: needle)
+}
+
+fn witness_apply_script_exceeds_local_argv_embed_budget() -> Bool {
+  let script_len = length(live_deploy_apply_script_for(spec: deployment_spec_srv1()))
+  let budget = byte_size_count(b: local_argv_embed_budget)
+  script_len > budget
+}
+
+fn witness_shell_exec_run_uses_stdin_transport() -> Bool {
+  src_has(path: shell_dag_path, needle: "stdin: script")
+}
+
+test fn shell_exec_run_argv_embed_witnesses() -> Bool {
+  witness_apply_script_exceeds_local_argv_embed_budget()
+    && witness_shell_exec_run_uses_stdin_transport()
+}