feat(gust): publish gust:os provider components (OCI + wasm.directory) — first demonstrator (gale#223)

[avrabe]

First concrete step of DD-OS-DELIVERY-001 (gale#223/#224): gust's OS-as-wasm-component-model made distributable — publish gale's gust:os providers as cosign-signed wasm components to the two channels a consumer pulls from.

What

• build-gustos-components.sh — builds each gust:os provider as a wasm component (wasm-tools component new) and asserts the delivery invariant: it exports gust:os/* and imports nothing outside gust:hal/*. A leaking scheduler/env/heap import (the core-module shape the release tarball ships) fails the gate.
• .github/workflows/gustos-publish.yml — a verify job gates the invariant on every PR; a publish job (tag/dispatch only) cosign-signs (keyless OIDC, same flow as release.yml) and pushes each component to ghcr OCI (ghcr.io/pulseengine/gale-nano-*) and wasm.directory (gated on WASM_DIRECTORY_TOKEN so it skips cleanly until the org sets it up).

First demonstrator — the time provider (verified locally)

world root {
  import gust:hal/mmio@0.1.0;   // residual = exactly gust:hal
  export gust:os/time@0.1.0;    // exports the gust:os capability world
}

build-gustos-components.sh → ok: exports gust:os (1 iface), residual import = gust:hal only. This is a real, signed, multi-consumer gust:os component — any downstream that imports gust:os pulls it and fuses it for its target (jess#167 is the first of several consumers).

Scope / honest notes

• The shape oracle (build + invariant) runs and passes locally + on every PR now. The publish step (cosign + ghcr + wasm.directory) runs in CI on a release tag where the OIDC/registry creds exist — wired here, exercised at the next tag.
• This is the minimal provider demonstrator; the full fused gale-nano runtime component (executor + all providers, residual gust:hal only) is gale#224, bound to the v0.6 cut.

Refs: gale#223, gale#224, DD-OS-DELIVERY-001, jess#167.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!