SHELL-DAG: migrate six retained_foreign call sites to typed operations

[gunbai-bot]

Summary

Dissolves six confirmed retained_foreign (shell-string-concat) call sites onto typed shell/extdeps operations (dashboard node adhoc-a84c2852-5b9), per §3/§5: construction over string-building, reusing existing single authorities rather than forking.

Sites migrated

1. dag/gunbc/package_delivery.dag observe_protocol_schema_identity — codex app-server generate-json-schema -o invocation → new codex_app_server.Cli.GenerateJsonSchema (added to extdeps.llm.codex_app_server, which already cites this executable/protocol — not a new product surface).
2. Same function — find ... -type f -name '*.json' | sort listing → new shell.Find.FilesByNameSorted (extdeps/shell.dag), following the existing FilesAndSymlinksWithMode positional-parameter precedent so no path/glob can escape a quote.
3. finish_bisect_generate_protocol_schema_dir — duplicate of Add SVG viz, test helpers, and makegen scaffold #1, same new op.
4. relocate_build_root_to_unique_publishing — rmdir '<staged>' && mv -T '<build_root>' '<staged>' → shell.Remove.EmptyDirectory + shell.Move.NoReplaceDirectory (two new operations on the existing shell.Remove/shell.Move services).
5. rename_publishing_noreplace — mv -T → shell.Move.NoReplaceDirectory.
6. dag/tools/interpreter_dispatch_bijection_real_roster_transport.dag real_roster_cargo_run — multi-line bash (set -euo pipefail; cd; export; two cargo test --ignored --exact invocations) → new cargo.Build.TestWithCwdEnv (extdeps/rust/cargo_build.dag), composing env -C <workdir> <VAR=val...> <cargo> test <args> as one argv vector, called twice sequentially from real_roster_cargo_test_run with explicit caller-side short-circuit (cargo_outcome_holds) preserving fail-fast semantics without shell chaining.

No sites were left as retained_foreign — all six are fully migrated.

Architectural calls made (documented per task brief)

• RunArgv vs narrow op: used a narrow, domain-specific codex_app_server.Cli.GenerateJsonSchema instead of shell.Exec.RunArgv + ProcessArgvExpansion/CliSurface, which has zero production consumers today and is disproportionate machinery for a one-off fixed 4-token argv — matches the narrow-fixed-argv-per-tool pattern used everywhere else.
• rmdir vs rm -rf: shell.Remove.EmptyDirectory uses rmdir (refuses when non-empty), preserving the original script's safety property rather than silently loosening it.
• Site 4 control flow: computed a plain Bool in each branch rather than unifying two different services' anonymous {success: Bool} output records across an if/else, to avoid a speculative cross-type merge.
• Site 6 cwd+env: reused the env -C {workdir} argv-splice precedent already in cargo_build.dag (BuildInheritEnv, BuildManifest), adding a List<String> env-var-words parameter following the extra_args precedent — no new grammar/transport machinery needed.

Follow-up: state-space conflation in site 4 (review on this PR, 69f9364)

relocate_build_root_to_unique_publishing originally collapsed two distinct typed outcomes — shell.Remove.EmptyDirectory failing (placeholder not empty: something else wrote into a name this call believed was exclusively its own) vs. shell.Move.NoReplaceDirectory failing (ordinary move refusal against a confirmed-empty, confirmed-ours placeholder) — into one Bool at the binding. Under that Bool, the not-empty case ran shell.Remove.RecursiveForce on the placeholder, i.e. deleted a directory whose contents this call could not account for. Nobody flagged that as a defect during initial review; it fell out of the decomposition once the two outcomes were split into UniquePublishingRelocateOutcome { Ready | PlaceholderNotEmpty | Refused }. The PlaceholderNotEmpty arm now skips the cleanup; RecursiveForce only runs on the move-refusal arm, where emptiness is established.

Caveat on the compile-clean claim below: compile_clean_diagnostic_is_advisory admits WhereRefinementUnenforced onto the non-blocking allowlist for any non-literal refined value, and where refinements are unchecked at runtime for casts whose kernel is String (which is NonEmptyStr's case) — so "0 blocking errors" is not evidence that any non-literal as NonEmptyStr/as FilePath cast in this diff actually holds. The two new as NonEmptyStr casts added here are on string literals, not non-literal expressions, so they fall outside that gap; no claim in this PR rests on an unchecked refinement.

Incidental fixes

• Two DESIGN §4c violations: explanatory // comments were nested inside a service { } body (module-item grain only is admitted) — relocated into top-level data ..._note declarations in shell.dag and cargo_build.dag, matching the files' existing convention.
• An interpolation hazard: the new cwd/env note's prose contained a literal {workdir}, which the compiler parsed as an unbound interpolation reference (undefined variable 'workdir') — reworded to plain prose.
• A missing NonEmptyStr import in cargo_build.dag (advisory-level, fixed for correctness).

Verification

• Entry-scoped gunbc compile on both touched leaf files is 0 blocking errors on both:
  • dag/gunbc/package_delivery.dag: 395 advisory diagnostics, all the file's pre-existing where-refinement unenforced pattern on non-literal FilePath/NonEmptyStr casts, unrelated to this change.
  • dag/tools/interpreter_dispatch_bijection_real_roster_transport.dag: 14 advisory diagnostics, same pre-existing pattern plus two on my own new as NonEmptyStr casts, consistent with the file's existing style.
• gunbc.retained_shell_script's retained_foreign carries no fixed caller-count assertion, and none of these six sites appear in host_language_transport_script's wall_residue_live_test.dag roster — no lens update required.
• dag/test/claim/cargo_execution_placement_witness_test.dag (hermetic controls covering the placement-decision logic site 6 also uses) passes — ran w_local_runner_admits_its_observed_path via gunbc run --claim-run.
• The interpreter_dispatch_bijection_real_roster witness (real git clone + cold cargo build, ~692s wall) was not executed in this session — its own test file documents it as "a cadence job, not a session job" requiring a runner with ~11 GiB and a local cargo. gunbc run --dry-run on the unmodified real_roster_cargo_decision confirms it hits the expected hermetic-mock wall at shell.Which.Check (pre-existing behavior, unrelated to this change).
• Full 3-root compile-clean gate not run locally (documented OOM on remote dispatch, per project memory) — relying on CI.

Test plan

• CI compile-clean gate green
• Reviewer spot-checks the six diffs against the six cited sites