[CI] Compile generated UCI 2.5 output with bounded memory #1

Current gap

The CI workflow builds only the PolyXML CLI, then runs python3 runner.py --bin "$POLYXML_BIN". The runner executes polyxml validate and polyxml build --dry-run. It neither emits generated source nor invokes any destination-language compiler. Its module-graph result can therefore pass while generated UCI 2.5 source fails to compile in all seven targets (observed 2026-09-28). The runner docstring's claim of codegen/compilation benchmarking is misleading for the current behavior.

Proposed bounded gate

Add an opt-in or separate CI job that builds the exact four-schema [modules.defense_uci] into a temporary output directory, then serially checks Python, Go, C++, Java, TypeScript, C#, and Rust. Keep the existing fast validation/dry-run job. Use per-language timeouts and a real memory limit (cgroup/systemd-run or repository scripts/memcap.sh where available); do not launch the language compilers in parallel. Log generated file counts/sizes, elapsed time, peak RSS, and first compiler errors. Treat missing toolchains explicitly in local runs, while CI installs the required versions.

Done when

• CI emits actual UCI 2.5 code and runs destination-language syntax/compile checks, serially and within a documented memory budget.
• The gate fails on any generated-code failure and retains concise actionable logs/artifacts.
• The runner description reflects what it actually checks.
• The new gate passes after the linked PolyXML compiler issues are fixed.

PolyXML compiler issues will be linked after creation.

Linked compiler work

• Multi-namespace UCI type ownership / missing types
• Multiline documentation syntax
• Rust raw identifier locals
• Oversized compilation units / memory

Local status (not merged)

After the PolyXML fixes in progress, five UCI targets pass bounded checks: Python syntax, Go, TypeScript, Java, and C#. Rust and C++ exceed practical memory budgets on the 8 GiB development host even after syntax/alias fixes; keep the gate staged until #92 provides a safe split strategy or a larger CI runner.

Reproducible check added locally (not merged)

polyxml-schema-corpus/scripts/check_uci_codegen.py now creates an isolated temporary UCI manifest, generates and compiles Python, Go, TypeScript, Java, and C# serially, using the PolyXML memory-cap wrapper at 35% of available RAM and a timeout per command. A complete local run passed all five. CI wiring remains pending until the PolyXML fixes are merged; Rust and C++ need the size work in #92 before joining a bounded compile gate. The existing runner.py validation/dry-run path remains separate.

Draft PRs

• Compiler fixes
• Five-target bounded check; CI wiring and Rust/C++ remain open.