Group the sources into aliased modules and lint with the published plugins (#23)

Groups the flat `src/` into cohesive modules and turns on the published lint plugins. No behavior change.

## Module layout

Each module is a direct `src/` subfolder with an `index.ts` barrel and a `#` alias in `package.json` `imports` (layer order, top first):

| Alias | Files |
| --- | --- |
| `#prepare` | `index.ts` (the prepare phase entry point) |
| `#run` | `index.ts` (the run phase entry point) |
| `#post` | `index.ts` (the post phase entry point), `post.ts`, `post.test.ts` |
| `#agents` | `auth.ts`, `opencode.ts` (Codex / Claude Code sign-in, OpenCode args and output) |
| `#processes` | `child.ts`, `isolation.ts` |
| `#runtime` | `runtime.ts`, `credentials.ts` |
| `#profiles` | `profiles.ts` |
| `#common` | `errors.ts`, `json.ts` |
| `#testing` | `index.ts` (unchanged) |

Every top-level entry of `src/` is an aliased module folder. Tests stay next to their code as `*.test.ts`. Each phase's `index.ts` is its entry point, and `action.yml` now runs `node src/<phase>/index.ts`. The post phase's logic moved to `src/post/post.ts` so its test can import it; `index.ts` keeps the env reading and the `import.meta.main` call. `run`'s prompt URL is now `../../prompt.md`. `scripts/protect-source.sh` now copies `src/` recursively (it used to copy `src/*.ts` only), and the workflow test checks that module files get staged too.

## Lint plugins

- New devDependencies: `eslint-plugin-explicit-types@^0.6.1` and `eslint-plugin-import-structure@^0.10.2`, both in `jsPlugins`. The lockfile comes from a real `npm install`.
- Enabled configs: `importStructure.configs.modules`, `explicitTypes.configs.concrete`, `explicitTypes.configs.absence`.
- **explicit-types `naming` is off** (the other app repos turn it on). Its `upper-snake-string-unions` and `no-upper-snake-object-keys` rules fire on wire tokens this repo doesn't choose: profile types `"claude" | "codex" | "opencode"` from `profiles.json`, failure reasons posted to Gitea, Gitea's `"new" | "old"` side, and environment variable names such as `PATH`. Satisfying them would change behavior or need opt-outs. This is logged as an open question for the user.

Lint fixes, all type-level:
- `Pick<BotProfile, "type" | "model">` became a named `ProfileIdentity` interface that `BotProfile`, `ProfileFailure`, and `RuntimeProfile` extend. `RuntimeOutcome` is now `RuntimeSuccess | RuntimeFailure`.
- Inline object types became named interfaces.
- `Record<string, string>` env maps became `NodeJS.ProcessEnv`. `JsonObject` and the verdict table became `NodeJS.Dict<…>`.
- `T | undefined` locals and returns became `T | null` with matching checks. `typeof fetch` became a `Fetcher` type.
- Claude's result fields are held in camelCase (`isError`, `apiErrorStatus`) after parsing, because `id-match` rejects snake_case interface members.
- Duplicate import sources are merged (`import-structure/no-duplicate-import-source`).

## Verification

- `vp check`: clean.
- `vp test`: 61 passed and 5 skipped as a normal user. All 66 passed as root in `node:24-bookworm`.
- Each phase (`node src/<phase>/index.ts`) run from a `protect-source.sh` copy loads its full alias graph under Node.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #23
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

src/runtime/runtime.ts

@@ -0,0 +1,124 @@
+import { chmod, chown, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { isMapping } from "#common";
+import type { ProfileFailure, ProfileIdentity } from "#profiles";
+
+import { parseCredentials } from "./credentials.ts";
+
+const FIRST_PROFILE_UID = 20_000;
+
+export interface RuntimeProfile extends ProfileIdentity {
+  index: number;
+  uid: number;
+  gid: number;
+  home: string;
+  tokenFile: string | null;
+}
+
+export interface RuntimeManifest {
+  runtimeDir: string;
+  manifestPath: string;
+  reviewerFile: string;
+  outcomeFile: string;
+  profiles: RuntimeProfile[];
+}
+
+export interface RuntimeSuccess {
+  ok: true;
+  body: string;
+  reviewPath: string;
+  anchorsPath: string;
+  profile: ProfileIdentity;
+}
+
+export interface RuntimeFailure {
+  ok: false;
+  failures: ProfileFailure[];
+}
+
+export type RuntimeOutcome = RuntimeSuccess | RuntimeFailure;
+
+async function writePrivate(path: string, value: string, uid: number, gid: number): Promise<void> {
+  await writeFile(path, value, { mode: 0o600 });
+  await chmod(path, 0o600);
+  await chown(path, uid, gid);
+}
+
+export async function prepareRuntime(
+  actionPath: string,
+  runtimeRoot: string,
+  masterKey: string,
+): Promise<RuntimeManifest> {
+  const credentials = await parseCredentials(
+    await readFile(join(actionPath, "profiles.json"), "utf8"),
+    masterKey,
+  );
+  const runtimeDir = await mkdtemp(join(runtimeRoot, "bot-agents-"));
+  try {
+    await chmod(runtimeDir, 0o711);
+    const reviewerFile = join(runtimeDir, "reviewer-token");
+    await writePrivate(reviewerFile, credentials.reviewerToken, 0, 0);
+
+    // One profile at a time, in order, as each claims the next UID.
+    const profiles = await credentials.profiles.reduce<Promise<RuntimeProfile[]>>(
+      async (previous, profile, index) => {
+        const prepared = await previous;
+        const uid = FIRST_PROFILE_UID + index;
+        const home = join(runtimeDir, `profile-${index}`);
+        await mkdir(home, { mode: 0o700 });
+        await chmod(home, 0o700);
+        await chown(home, uid, uid);
+        const tokenFile =
+          profile.token === undefined || profile.token === "" ? null : join(home, "token");
+        if (tokenFile !== null && profile.token !== undefined) {
+          await writePrivate(tokenFile, profile.token, uid, uid);
+        }
+        prepared.push({
+          index,
+          type: profile.type,
+          model: profile.model,
+          uid,
+          gid: uid,
+          home,
+          tokenFile,
+        });
+        return prepared;
+      },
+      Promise.resolve([]),
+    );
+
+    const manifestPath = join(runtimeDir, "manifest.json");
+    const manifest: RuntimeManifest = {
+      runtimeDir,
+      manifestPath,
+      reviewerFile,
+      outcomeFile: join(runtimeDir, "outcome.json"),
+      profiles,
+    };
+    await writePrivate(manifestPath, JSON.stringify(manifest), 0, 0);
+    return manifest;
+  } catch (error) {
+    await rm(runtimeDir, { recursive: true }).catch(() => {});
+    throw error;
+  }
+}
+
+function isRuntimeManifest(value: unknown): value is RuntimeManifest {
+  return (
+    isMapping(value) &&
+    typeof value["runtimeDir"] === "string" &&
+    typeof value["manifestPath"] === "string" &&
+    typeof value["reviewerFile"] === "string" &&
+    typeof value["outcomeFile"] === "string" &&
+    Array.isArray(value["profiles"])
+  );
+}
+
+export async function readRuntimeManifest(path: string): Promise<RuntimeManifest> {
+  const value: unknown = JSON.parse(await readFile(path, "utf8"));
+  if (!isRuntimeManifest(value)) {
+    throw new Error(`${path}: invalid runtime manifest`);
+  }
+  return value;
+}