Embedded CLI components: freshness gate only sees sample-suite-visible behavior

[lann]

Follow-up from #86's review (non-blocking finding #3).

The CLI bakes in size-optimized builds of components/runner-cli and components/provider (crates/component-test-cli/embedded/, regenerated by just embed-update) as the compose-runner/run defaults. Freshness is enforced behaviorally: just verify-cli diffs the embedded artifacts' composed output against the Path-2 goldens. Byte-comparing a rebuild against the committed copies is deliberately off the table — builds are not reproducible across environments (#44).

The gap: a change to runner-cli or provider whose behavior the sample-suite goldens don't exercise — trap handling in the composed core, diagnostics edge cases, provider stream corner cases, JSONL fields only emitted on unusual paths — leaves embedded/ stale with no gate tripping. Today's mitigation is the embed-update reminder in AGENTS.md and the justfile recipe comments.

Options, in increasing machinery:

1. Accept + document (status quo; this issue is the record).
2. Widen the goldens: add a composed-run leg over a second suite to verify-cli. Note the trap fixture doesn't transplant: the composed core is single-instance execute-everything, so fixture-suite's deliberate trap would poison the whole run — which is exactly why Path 2 has no fixture leg today. A non-trapping fixture (generated rows + tagged pair) would still widen coverage of the wire format.
3. Advisory rebuild job in CI: rebuild with the embed profile and warn (never fail, per Lockfile artifact-sha256 binding vs non-reproducible suite builds #44) when bytes differ from the committed copies. Noisy across toolchain bumps; possibly still a useful nudge on PRs touching those components.

Not blocking anything — filed so the decision is recorded rather than re-derived.

[lannbot]

Resolution: none of the three options — #92 dissolves the problem instead. The embedded components are now built from source by the CLI's build.rs (nested cargo into OUT_DIR, broad rerun-if-changed, curated env, --locked --profile embed), so there is no committed artifact to go stale and nothing for a gate to miss; verify-cli becomes a pure behavior gate.

The concern that originally ruled this out — cargo install cost and the wasm-target requirement — dissolved under measurement: install time is 47.6s vs 47.7s at the committed-blob baseline (the inner wasm graph builds entirely in the shadow of the wasmtime compile), and the target requirement is covered by (a) every suite-building consumer already carrying wasm32-wasip2, and (b) a --no-default-features host-only build for wasm-free contexts, which the aggregate action's fallback install now uses.

Closes with #92.