feat!: WASM-only parser path; drop native tree-sitter from runtime

[theagenticguy]

Summary

Make npm install -g @opencodehub/cli@latest bulletproof on every common multi-Node-installer setup (mise / nvm / Homebrew / Volta / corepack) across Node 20/22/24 on Linux + macOS. Two compounding install failures share one root cause: the published cli pulled 13 native tree-sitter-* grammar packages plus tree-sitter@0.25.0 core through @opencodehub/ingestion, including tree-sitter-swift@0.7.1 which transitively depended on tree-sitter-cli@0.23.2 whose postinstall fetched a platform binary from GitHub releases. A 504 from that endpoint broke every cold-cache install.

This PR makes WASM the only parser path at the published boundary. All 15 grammar .wasm blobs plus the web-tree-sitter runtime wasm are vendored at packages/ingestion/vendor/wasms/. Native tree-sitter and the 14 grammar packages are removed from runtime AND devDependencies — they're not workspace deps anymore. Re-vendoring grammars is a one-shot operation documented in scripts/build-vendor-wasms.sh.

Verified locally via scripts/verify-global-install.sh local: 9/9 gates green. Install completes in 16s (was 84s with native; budget 60s). Zero ERESOLVE warnings. Zero GHCR fetches. Zero tree-sitter-cli postinstall.

Failing install transcript that triggered this work

npm install -g @opencodehub/cli@latest
...
npm warn ERESOLVE overriding peer dependency  (× 7 grammars)
...
npm error code 1
npm error path /home/.../node_modules/@opencodehub/cli/node_modules/tree-sitter-cli
npm error command failed
npm error command sh -c node install.js
npm error Downloading https://github.com/tree-sitter/tree-sitter/releases/download/v0.23.2/tree-sitter-linux-x64.gz
npm error Download failed
npm error status: 504

BREAKING CHANGES

• Parser runtime is WASM-only. OCH_NATIVE_PARSER env var and --native-parser CLI flag are removed. Setting the env var emits a one-shot stderr advisory and is then deleted from process.env. Passing the flag exits non-zero with commander's unknown option error.
• engines.node lowered to >=20.0.0 (native ABI requirement removed).
• @opencodehub/cli 0.3.0 → 0.4.0
• @opencodehub/ingestion 0.3.2 → 0.4.0
• @opencodehub/pack 0.1.3 → 0.2.0 (its dep on ingestion@0.4.0 is breaking)
• @opencodehub/cobol-proleap 0.1.3 → 0.2.0 (same reason)

Highlights

• wasm-fallback.ts → wasm-runtime.ts. Resolver collapsed to a flat Record<LanguageId, string> map. Parser.init({ locateFile }) pins the vendored runtime WASM. parse-worker.ts 308 → 144 lines. grammar-registry.ts 337 → 200 lines. ~600 LOC of native dispatch code deleted.
• complexity.ts ported to web-tree-sitter. Cyclomatic complexity now runs on every install (was silently zero on Node 24 default).
• verdict.test.ts adds a tier-flip fixture confirming the complexity → verdict pipeline still drives risk-tier consumers (verdict.ts:101,688).
• New scripts/verify-global-install.sh packs every publishable workspace package and runs 5 hard gates + 4 smoke commands.
• New .github/workflows/verify-global-install.yml runs the 9-cell install matrix (Linux/macOS × Node 20/22/24 × mise/nvm/Homebrew/Volta).
• ADR 0013 marked superseded; ADR 0015 captures the new shape.
• CHANGELOG entries added; CLAUDE.md, root README.md, and 14 docs-site pages scrubbed of OCH_NATIVE_PARSER / --native-parser references.

Provenance

• Multi-explorer plan: planning/bulletproof-npm-install/{explorer-architectural,explorer-speed,explorer-simple,plan.md}. Three independent Opus 4.7 agents converged on the same target shape — high-confidence signal the architectural call is correct.
• Durable lesson persisted: .erpaval/solutions/best-practices/workspace-tarball-pack-all-publishables.md — workspace clis whose deps reference other workspace packages need ALL publishable tarballs supplied to npm install -g, otherwise npm pulls registry copies and masks install-graph regressions.

Test plan

• pnpm -r build && pnpm -r test green workspace-wide (after dist clean)
• bash scripts/verify-global-install.sh local 9/9 gates pass
• node packages/ingestion/scripts/verify-vendor-wasms.mjs exits 0
• pnpm pack -C packages/cli produces tarball with @opencodehub/ingestion@0.4.0 pin
• npm install -g <tarballs> runs codehub --version / --help / analyze / query cleanly with no GHCR fetches and 16-second wall time
• CI 9-cell matrix (.github/workflows/verify-global-install.yml) — first run on this PR
• Tarball-pack gates (release-please) bump all 4 packages (cli, ingestion, pack, cobol-proleap) in the same release