refactor: single Go binary for all block-runner types

[grubmeshi]

Single squashed commit: replaces the JVM/Gradle multi-module tree with one Go module at the repo root. Based directly on current main.

What

• cmd/<persona> fit entrypoints (tf/manual/gitlab/azdevops/github) + cmd/bbrunner (controller / forced single persona / out-of-cluster all-types in-process superset that can replace meshfed-release's multiplexing-block-runner).
• internal/*: shared core (meshapi, crypto, config, report, mgmt, dispatch, k8sjob) + one dispatch.RunHandler package per persona. Layering enforced by depguard + an AST logging-stack test; single log/slog stack.
• Contracts preserved byte-for-byte (claim/register/status wire shapes, k8s Job contract, image names/ports, metric names); new series + env/YAML aliases are additive and warn.
• Green: task lint 0 issues, task test -race, all 11 domain/shared packages ≥90 % coverage, golangci-lint v2, Go-only CI.

Docs

docs/ARCHITECTURE.md (maintained record), docs/DEPRECATIONS.md, CROSS_REPO_TODO.md, and FOLLOW_UP.md — the forward plan: the live-acceptance gate (required before merge), the tf in-process default + Manager deletion (with the deferred shared-report adoption and ABORTED-on-shutdown), and the cross-repo meshfed-release hand-offs.

History

The full phase-by-phase history + the planning archive (run logs, detail plans, errata) are preserved on backup/consolidated-full-history. Supersedes the earlier stacked PRs #51–#64.

Before merge (FOLLOW_UP.md §A)

Live local-dev-stack acceptance (TERRAFORM + MANUAL + kind controller smoke) and confirmation that meshStack's coordinator accepts the decrypt-failure FAILED wire change.

🤖 Generated with Claude Code

[grubmeshi]

Review feedback addressed (4 follow-up commits)

Thanks for the review — here's how each point was addressed. New commits on this branch:

Commit	Scope
1235c56	README: terminology + table + dispatch-description fix
89411ce	ARCHITECTURE: present-tense rewrite + observability + future-direction
771fdd3	DEPRECATIONS: per-surface sections, no timeline framing
0cc9867	refactor: shared internal/valuestring helper

Terminology — drop "persona", use "runner type"/"type"

Aligned all docs (README + ARCHITECTURE) on the meshStack-established "runner type"/"type", with ALL = the run-controller. The code-wide rename (~50 files, the persona type + personaTf constants + the bbrunner <type> subcommand naming) is mechanical but large, so it's captured as a scoped follow-up with an effort estimate in ARCHITECTURE.md §8 — best done as its own reviewable commit rather than ballooning this diff.

README

• Table restructured: five fit runners first, run-controller (ALL) separated and last; column renamed to Type + cmd/ entrypoint.
• Fixed the single-run/dispatch paragraph that read as tf-only — clarified single-run is shared by every type and the controller dispatches a Job for any non-ALL type by selecting that type's image. Verified in code: internal/k8sjob/kubernetes.go picks the image from the operator-supplied implementations[run.Type] map — no per-type branch.
• Removed the "what it's not" negations from the repo-structure section.

ARCHITECTURE

• Removed all historic/refactor narrative (no more "ported from Kotlin", the old argv[0]/mux approach, "P2.1 closed", the poll-interval Kotlin @Scheduled detail, "ported runners"). It now reads as a present-tense design record.
• Relaxed the strict no-subpackages rule (a domain package like internal/tf may grow subpackages as it earns them).
• Package map is now illustrative + domain-driven-shaping, aligned with the actual depguard prometheus grouping.
• New §6 Observability: documents the pull model, the real gap (Job-dispatched single-run pods serve no listener → no scrape path for per-run metrics), and a push-gateway design with a ~2–3d effort estimate (prometheus/client_golang/prometheus/push is already available, no go.mod bump). Also notes the mgmt → observability / port rename idea — mgmt already takes a plain address, so it's a <1d mechanical rename, deferred to keep this diff focused.
• §8 Future direction replaces the follow-up/history dump: each item is a design sketch + effort estimate (lean run-controller via build tags ~3–5d incl. an init() registration seam; generic JSON HTTP client ~2–4d; etc.).
• Dropped the cross-repo TODO references.

DEPRECATIONS

Dropped the removal-timeline framing (reduced to a one-line policy) and converted the alias table into one content-focused section per surface.

HTTP client dedup

Landed the safe first step: the duplicated scalar value-stringification (azdevops.renderValue / gitlab.valueString, functionally identical) is now shared as internal/valuestring.Render. The larger generic client direction (shared no-redirect client builder + lifting meshapi's retry transport into a shared package) is documented as a design + ~2–4d estimate in §8 — the per-type request/error bodies deliberately stay per-package since each pins a frozen, byte-exact wire/error-message contract (and adding retry/timeout where a client has none today is a behaviour change to schedule deliberately).

All gates green: task lint (0 issues), task test (-race), task coverage (every package ≥ 90%, incl. the new internal/valuestring).

[grubmeshi]

Correction (re: value-stringification). My note above said github "does not stringify arbitrary values and does not use it" — that was inaccurate. github does have a stringifier (internal/github/inputs.go valueToString); it's just a deliberately different frozen Kotlin twin, so it stays per-package:

• nil → "" (vs valuestring.Render's "null"), and composites → fmt.Sprint Go format (vs compact JSON). Both are wire-visible.
• github applies it only to known scalars (the Mode-B tokens/endpoint and the sensitive-input decrypt path — regular user inputs are never dispatch inputs there), so fmt.Sprint/"" is the Kotlin-faithful choice for github specifically.

Only azdevops and gitlab were byte-identical and were the correct pair to fold onto the shared valuestring.Render. Documented the exception on valueToString in 1381693.