feat(project): unify native TypeScript and Rust builds

[Windsor Nguyễn (windsornguyen)]

What does this change?

This PR makes .bsmr the only project marker and configuration file. It also adds native TypeScript and Rust project discovery.

• .bsmr replaces .bsmrroot and .bsmrconfig.
• [project] root = "." prevents nested cells from changing project-root discovery.
• The pnpm importer preserves registry dependencies and link: workspace edges as different dependency types.
• Config-only tooling packages do not produce TypeScript library targets.
• Cargo discovery reads Cargo.toml, Cargo.lock, and an exact rust-toolchain declaration.
• Native Rust targets use deterministic cache keys and restore deleted outputs from the content-addressed store.
• Stable Rust is the default. A user can select an exact stable or dated nightly channel.
• Cargo actions remain local and cannot enter a remote cache until the action contract includes the Cargo registry and toolchain.
• Repository fixtures, examples, documentation, and validation use the single project file.

This branch includes the pending Node and cache stack. After #40 and #42 through #54 merge, rebase this PR onto main.

How was it tested?

• cargo fmt --all.
• cargo test -p bsmr_common --lib passed 134 tests.
• cargo test -p bsmr_client commands::init::tests:: --lib passed four tests.
• cargo test -p bsmr_client_ctx argfiles::tests:: --lib passed five tests.
• cargo check -p bsmr_interpreter_for_build.
• cargo build --bin bsmr.
• pnpm run ci check passed 40 tests and the workflow security checks.
• pnpm run ci check license.
• node --test prelude/toolchains/pnpm/runner.test.mjs passed 13 tests.
• git diff --check upstream/main..HEAD.
• The no-prelude example and root//rust:main built successfully.
• A representative Rust library built in 30.39 seconds from a cold state and 0.03 seconds from a warm state.
• Restoring its deleted output from the content-addressed store took 0.59 seconds. The restored artifact matched its original SHA-256 digest.

Full-workspace Clippy remains blocked by existing lints in bsmr_protoc_dev and bsmr_common. The scoped checks cover the changed implementation.

• CLA/Vouch check passes, or this PR only updates VOUCHED.td.

Reviewers

• Domain: annyzhou.
• Readability: Aryan Mahajan (@aryanma).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​node-semver@​2.2.0
	cargo/​yaml-rust2@​0.10.4
	cargo/​lru@​0.16.4 ⏵ 0.18.2

View full report