Add the client side of the pre-render environment preflight

A render against a machine that is missing a runtime, a library, a credential
or an executable test script cannot succeed. It loops through failing tests
until it gives up, spending a credit on every attempt. This adds a preflight
that runs before the first functionality is rendered and turns that into a
single actionable failure up front.

The preflight has two layers. The static layer is deterministic and needs no
server: git and bash are installed, every configured test script exists and is
executable, the script flavour matches the platform, the build folder is
writable. The planned layer asks the server which checks this particular
project needs, given its specs, linked resources, test scripts and a
description of the host.

A plan from the server is untrusted input, so env_check/checks.py is the only
place that turns a plan entry into an action, and it never executes a string
the plan supplied. A plan selects a type from a fixed registry and supplies
arguments that are validated first; binaries are resolved through which() and
spawned from an argument list without a shell; the only flags ever passed to a
binary the client did not choose are version flags from an allowlist.
Everything that does not validate is dropped with a recorded reason rather than
raising, so a malformed or unrecognised entry can never stop a render.

Only a failed error-severity finding blocks. Warnings, skipped checks, an
unreachable server and a context that cannot be assembled all leave the render
free to proceed.

Adds --skip-env-check to bypass the preflight and --env-check-only to run it
without rendering, which exits non-zero when the environment is not ready.

Author: VitjanZ

codeplain_REST_api.py

@@ -173,6 +173,27 @@ def status(self):
         }
         return self.post_request(endpoint_url, headers, payload, None, num_retries=0, silent=True)
 
+    def check_environment(self, environment_context: dict, run_state: RunState) -> dict:
+        """
+        Asks the server which environment checks this project needs before rendering starts.
+
+        Args:
+            environment_context (dict): The specs of every module, their linked resources,
+                                        the configured testing scripts and a description of
+                                        the host machine.
+            run_state (RunState): The current state of the rendering process.
+
+        Returns:
+            dict: A check plan with "checks" (probes the client executes locally) and
+                  "advisories" (findings that need no probe).
+        """
+        endpoint_url = f"{self.api_url}/check_environment"
+        headers = {"X-API-Key": self.api_key, "Content-Type": "application/json"}
+
+        # The planned layer is best effort: the caller falls back to the client's own
+        # deterministic checks when this call does not succeed, so it retries only once.
+        return self.post_request(endpoint_url, headers, dict(environment_context), run_state, num_retries=1)
+
     def render_functional_requirement(
         self,
         frid: str,

env_check/__init__.py

@@ -0,0 +1,12 @@
+"""Pre-render verification that the machine can actually build and test the project."""
+
+from env_check.preflight import run_environment_preflight
+from env_check.report import format_failure_summary, print_report
+from env_check.types import PreflightReport
+
+__all__ = [
+    "run_environment_preflight",
+    "print_report",
+    "format_failure_summary",
+    "PreflightReport",
+]