go.mod: take the shared libraries' current heads

ecore for mcphttp and the hot-path work, core for the errors fix: its seven
gqlerror sentinels were package-level pointers that gqlgen stamped with the
first field path they ever took, which was a wrong answer, a cross-request
leak and a data race.

web: render memory bodies as markdown, and resolve their references

A memory's value is markdown and always was: `bd remember` stores what was
typed, and what is typed is the same prose the memory files carry — bold
leaders, code spans, fenced recipes, and [[slug]] references to related
memories. The view printed it as pre-wrapped paragraphs, which shows the
source rather than the document and leaves every reference a dead end.

The renderer is web/markdown.go, one shared goldmark with three departures
from stock:

  - [[slug]] is an inline parser rather than a text rewrite, so a reference
    written inside a code span stays text by construction.
  - Raw HTML is escaped and shown, not dropped. The safe default omits it,
    and these memories are full of <placeholder> spellings CommonMark reads
    as tags; omitting one rewrites SRHT_<NAME>_VER to SRHT__VER silently,
    which is worse than showing markup.
  - An image renders as a link. An <img> at another host is a request that
    host makes on behalf of whoever opened the page.

References resolve across databases, because that is where they point: the
mirroring workflow files a memory by its type, so a related memory is as
likely to be in another tracker as in this one. The index is the one the
issue links already use — issue_prefix and the kv.memory.* keys are rows of
the same config table, so one read per database now answers both questions
and one cached projection carries both. A slug two trackers hold resolves to
the first listed, the page's own database, unlike a prefix two trackers claim
which resolves to neither: the same slug in two trackers is normally one
memory that was re-filed and left a copy behind.

A slug nobody wrote and a slug held by a database the caller may not browse
are one rendering — a muted, inert marker. A link, a distinct class or a
different tooltip would each publish the existence of a private database.

Memory.Paragraphs goes with the paragraphs it existed for.

graph: a read schema for dolt.sr.ht at /query

This service had no GraphQL at all, so nothing on the instance that already
speaks SourceHut GraphQL could read it — not hut, not a script written
against git.sr.ht's API, not api.sr.ht, which federates by fetching each
service's /query. Everything else here has one; this is the missing surface
rather than a new idea.

The schema answers what a database IS: the listings under the store's own
visibility rule, one database by owner and name, its branches, commit log and
table list, and its ACL to the owner alone. Rows and diffs stay on /mcp,
where a read that had to be clipped says so in its own answer — a shape this
schema would have to reproduce field by field to stay honest. There are no
mutations, for spec.sr.ht's reason: a federated type is a consumed contract,
and creating, renaming and deleting a database is young code.

Access is not spec.sr.ht's single-owner gate but this service's own matrix,
applied per field: the bearer plane /mcp defines, then core.Allowed over the
caller's grant. Anonymous is a normal caller — which is why the endpoint
cannot be mounted the way core-go's WithSchema mounts one — and a database
the caller may not see resolves to null rather than to an authorization
error, so its existence cannot be read out of the shape of the refusal.

model.Database is hand-written and branches/log/tables/acl are resolver
fields on purpose: as generated struct fields they would open one bare store
per row of every listing. A test asserts a metadata query opens none.

Codegen is a module-independent `go run …@v0.17.94`, so the generator's
dependency tree stays out of go.mod. v0.17.36 — the version spec.sr.ht
pins — still cannot be run that way: its module pins an x/tools this
toolchain refuses to compile, which generate.go records.

mcpsrv: serve a stateless read-only MCP surface

deps: tidy after the ecore uplift

deps: bump sr-ht-ecore and auxilia to v0.7.0

log: take the logrus bridge from auxilia

The bridge was written here because remotesrv.ServerArgs.Logger demands a
*logrus.Entry and nothing else, and letting it log around our handler meant
its records skipped the masks. None of that is specific to dolt or to
SourceHut, so it now lives in auxilia beside scribe, where the next library
that demands a logrus entry can reach it.

log: replace logrus with slog behind auxilia's scribe handler

Every logger field this service owned was a *logrus.Entry threaded
through a constructor, which is what logrus costs for want of a usable
default. They are slog.Default().With("component", ...) now, and the
threading is gone with them; the shared middleware's panic reports land
in the same handler, which is why the daemon sets the default before
anything that can fail.

The handler is scribe's tint handler: level from [dolt.sr.ht]log-level,
source positions, and masks keyed on the attribute path for the three
credentials this service handles — the unified-login cookie, the
Internal fernet token and the Authorization header the remotesapi reads
a PAT or a keypair JWT out of. Errors go through scribe.Err, so a culpa
error's hint reaches the operator on its own line.

logrus stays in go.mod: dolt's remotesrv.ServerArgs takes a
*logrus.Entry and nothing else. It is now confined to Config.DoltLogger,
which is the only place this service names it.

dolt-git-hook is deliberately untouched: what it writes to stderr is the
notice a pushing user reads through git, not a log.

deps: bump sr-ht-ecore for slog panic reports

middleware reports a panic through slog's default logger now, with the
method, path, panic value and stack as attributes rather than one
formatted line. It logs through the default, so this service has to set
one — which the next commit does.

web: serve the static tree through ecore's assets

discoverStyleHref and the bare http.FileServer are sr-ht-ecore's assets
package now: one hashed-name pattern, the cache policy the hash implies
(immutable for a content-addressed name, an hour for the rest), and a
refusal to publish a directory listing of the build. The unhashed
fallback survives, but only when static/main.css is really there — an
href to a file this deployment does not ship is a 404 per page load,
which is what an empty Resolve exists to avoid.

web: draw the chrome from sr-ht-ecore

The brand, the service switcher, the login block, the environment banner
and the database listing were a local port of core.sr.ht's nav — one of
five such ports on this instance, and they had already drifted. They are
now sourcecraft.dev/bigbes/sr-ht-ecore/chrome, the one copy every custom
service draws from.

Deleted: web/chrome.go entire (navEntry, networkOrder, networkExcluded,
buildNetwork, basePage, loginURL, logoutURL), templates/nav.html,
templates/icons/circle.svg (ecore inlines the identical SVG), the
repoList partial, and the local dict/shortHash duplicates.

Added: one chrome.Service built in newApp from our config section with
the hashed stylesheet href set on it, a chrome.Page per request through
app.page, chrome.Attach on every template set, and chrome.Funcs as the
base of the funcmap. Handlers embed chrome.Page in their view structs
instead of copying its fields; the row browser sets ContainerClass to
container-fluid, since its column count is the table's and not ours.

Three behaviour changes come with ecore's policy, all deliberate: the
profile link now prefers hub's ~username page when hub.sr.ht is
configured (it was always meta's /profile), the brand carries a fixed
15rem min-width so the switcher starts at the same x on every service,
and a binary built without a stylesheet renders bare rather than linking
an empty href. The nav test went with the code it tested — ordering,
exclusions and login URLs are ecore's to cover — and what replaced it
asserts only what is ours: that pages are drawn through the chrome at
all, and that the row browser is full-bleed.

The auth path is untouched: a foreign bearer token is still accepted as
a meta.sr.ht PAT.

web: mirror the git twin's description onto companion databases

The internal create endpoint accepts a description, but its only caller
— dolt-git-hook — never sends one: git.sr.ht's push context does not
carry it. Companion databases therefore all sat descriptionless on the
dashboard while their git twins had perfectly good descriptions.

Resolve the description server-side instead: a GitDescriber dependency
(internal GraphQL query to git.sr.ht in the owner's name, the same
network-key trust the hook uses to reach us, pointed the other way) is
consulted on every /internal/repos call. A fresh companion is created
with the twin's description; for an existing one the push doubles as the
sync point — a changed, non-empty git description overwrites the stored
one. An empty git description never clobbers one set in dolt's own
settings, and every failure mode (no twin, git.sr.ht down, no resolver
wired) degrades to no mirroring. The lookup is capped at 3s so the
hook's own 5s POST timeout is never exceeded.

Adds testify as a direct dependency for the new tests.

build: pure-Go (CGO_ENABLED=0) build via a klauspost-backed gozstd shim

dolthub/dolt/go pulls in two hard cgo dependencies — go-icu-regex (SQL
REGEXP) and gozstd (NBS zstd compression) — which forced a C toolchain +
ICU headers on every build. Both are now avoided so the default build is
pure Go and statically linkable:

- ICU: build with `-tags gms_pure_go`, selecting go-mysql-server's stdlib
  regexp fallback. Safe because this service never runs the SQL engine
  (it serves bare NBS stores and browses read-only), so it never
  evaluates SQL REGEXP.
- zstd: `replace github.com/dolthub/gozstd => ./third_party/gozstd-purego`,
  a pure-Go drop-in over klauspost/compress/zstd (already in the graph).
  It reproduces the nine gozstd symbols dolt references. dolt is
  unmodified.

dolt uses gozstd only in its NBS archive subsystem; this binary hits only
the decompress side at runtime (archive dictionary TRAINING is gc/
archive-writer code we never run — the shim implements it over klauspost
but panics on the trainer errors that only that off-path use could
trigger). zstd frames and dictionaries are standard-format, so
libzstd-authored archives decode correctly; the shim's tests prove this
by decoding plain and dictionary-compressed frames produced by the zstd
CLI (libzstd).

The Makefile now defaults to CGO_ENABLED=0 + -tags gms_pure_go (override
with `make CGO_ENABLED=1 GO_TAGS=` for the cgo variant). Verified:
CGO_ENABLED=0 build of ./..., all unit tests, the real-dolt-CLI
integration + spike suites, and the shim's libzstd-interop tests, all
green with no cgo.

rename module to sourcecraft.dev/bigbes/sr-ht-dolt; depend on sourcecraft sr-ht-core

build: source core-go from the instance fork

Replace git.sr.ht/~sircmpwn/core-go with git.srht.bigb.es/~bigbes/core-go
at c2c2f38 (upstream fdb3662 + newer upstream commits + the phoebe-lab S3
UnsignedPayload patch) - the code production actually runs. Requires
GOPRIVATE=git.srht.bigb.es to fetch. Full suite re-verified including the
remotesapi integration scenarios.

cmd: doltsrht and doltsrht-migrate binaries, module tidy

foundation: module, core domain, schema, spike-verified dolt interop

Phase 0 foundation for dolt.sr.ht (pure-Go Dolt hosting for SourceHut).

Dependency pins:
- core-go v0.0.0-20260520082310-fdb3662452dc: the production instance's
  submodule commit (fdb3662); must never be upgraded so token/config/crypto
  behavior matches the rest of the instance.
- dolthub/dolt/go v0.40.5-0.20260626152440-45335d44ad79: pseudo-version at the
  commit tagged v2.1.10 (45335d44), matching the installed dolt CLI. The /go
  submodule's latest tag (v0.40.4, 2021) does not interop with a modern CLI;
  matching the CLI commit guarantees a common NBS format (Format_DOLT) and
  remotesapi proto.
- gopkg.in/go-jose/go-jose.v2 v2.6.3: same JOSE version dolt's creds package
  signs EdDSA keypair JWTs with, avoiding a duplicate JOSE lib.
- grpc v1.79.3, logrus v1.8.3, lib/pq v1.10.9, chi/v5 v5.3.1, brant v0.5.1.

Contents:
- core/ pure domain: models, ValidateName/ParseRepoPath, the access matrix
  (Allowed + NotFoundForPrivate), full table-driven tests.
- schema.sql + migrations/0001_initial.sql (brant format).
- config.example.ini, contrib/dolt.sr.ht.conf (nginx), Makefile, scss/main.scss,
  static/logo.svg, README, .gitignore.
- internal/smoke: throwaway import-and-build check (deleted in Phase 3).

Spike (storage/spike_test.go, tag `spike`): bare NBS store via WriteEmptyRepo,
served by remotesrv on an ephemeral single port, round-tripped through the real
dolt CLI v2.1.10 (clone -> insert -> commit -> push -> re-clone -> verify rows).
Green, no version juggling needed beyond selecting the v2.1.10 commit. FS must
be rooted at the repos dir (LocalFilesysWithWorkingDir) so sealed chunk-URL
prefixes are clean relatives.

Build note: dolt pulls go-icu-regex (CGO), which needs ICU4C headers; on this
Mac set CGO_CPPFLAGS/CGO_LDFLAGS to icu4c@78 (documented in README).