feat(res-to-affine): land tree-sitter grammar build pipeline (Phase 2a, Refs #57)

[hyperpolymath]

Summary

Phase 2 of affinescript#57 (.res → .affine migration assistant) replaces the Phase-1 line-regex scanner with a tree-sitter AST walker. The grammar is manifest-vendored at editors/tree-sitter-rescript/ (since #314), but the build pipeline that turns the manifest into a loadable parser had not been wired up. This PR is that wiring — Phase 2a foundation only, no walker yet.

What changed

• justfile — new install-grammar recipe wrapping editors/tree-sitter-rescript/scripts/install.sh.
• install.sh — error message when tree-sitter is missing now points at both cargo install tree-sitter-cli (Rust-native, repo-preferred per CLAUDE.md) and npm install -g tree-sitter-cli. Script behaviour is unchanged when the CLI is present.
• .github/workflows/ci.yml — new migration-assistant job that installs tree-sitter-cli from npm (the fast CI path — pre-built binary, ~5 s vs. ~5 min cargo install from source), runs just install-grammar, verifies tools/vendor/tree-sitter-rescript/src/parser.c was produced, and smoke-parses the existing fixture at tools/res-to-affine/test/fixtures/sample.res. Sits alongside vscode-smoke as a Node-using carve-out under the same reasoning (manifest dep on an npm-distributed CLI; no new TypeScript source in this repo).
• editors/tree-sitter-rescript/README.md — documents the dual install path, the new justfile recipe, and the CI gate.

Why split 2a from 2b

The original Phase-2 estimate ('Phase 2 = tree-sitter walker') silently assumed the build pipeline was ready. It wasn't — tools/vendor/tree-sitter-rescript/ does not exist locally for any fresh clone because install.sh had never been run. Splitting this out:

1. Surfaces and gates the environmental prerequisite explicitly in CI (the migration-assistant job is the first signal if the pinned commit stops building).
2. Lets Phase 2b land as a port-over-stable-infra change instead of infra+port mixed together.
3. Mirrors how Phase 1 itself was structured (feat(res-to-affine): Phase-1 migration assistant skeleton (Refs #57) #314 manifest, then docs(res-to-affine): corpus run + regex precision fixes (Refs #57) #319 corpus-run precision pass).

What's NOT in this PR

• No walker.ml, no AST-based detection logic, no --engine CLI flag.
• No change to the Phase-1 regex scanner — it remains the default and only engine.
• No tree-sitter generated artefacts checked in. tools/vendor/ is gitignored.

Phase 2b plan (next PR, stacks on this)

• walker.ml invokes tree-sitter parse on a .res file (subprocess approach — sidesteps OCaml↔C FFI, ample for an offline migration assistant).
• s-expression output parsed via sexplib0 (already in opam deps).
• Single anti-pattern ported: side-effect-import (the one docs(res-to-affine): corpus run + regex precision fixes (Refs #57) #319 had to band-aid heaviest with regex anchoring).
• New --engine={scanner,walker} CLI flag, default scanner to preserve Phase-1 behaviour.
• Snapshot tests compare scanner vs walker output on the corpus.
• README updated to document the new flag.

Test plan

• CI green — in particular the new migration-assistant job, which proves the install path end-to-end.
• Local: just install-grammar produces tools/vendor/tree-sitter-rescript/src/parser.c on a fresh clone (verified-by-design — install.sh is unchanged in code behaviour).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	13
🟠 High	17
🟡 Medium	12

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence