Add specs/trinity/build_graph: the build graph, pins and receipts (S03 of trinity#988)

[dmitrii-f-t27]

Closes #3565 -- work package S03 of gHashTag/trinity#988: the build graph, pinned dependencies and generation provenance. Stacked on #3578 (S02) and #3577 (S01): the diff shows all three until the earlier ones merge.

What

specs/trinity/build_graph.t27 (module trinity_build_graph, KIND = "build-graph") declares what the consumer's build is made of at 976df517: Zig 0.15.x required and 0.15.2 measured with on ubuntu-latest; zig build -Dci=true and zig build test -Dci=true, the latter with an exit code that does not reach the job (CI_TEST_EXIT_PROPAGATED = false, gHashTag/trinity#616, fix proposed in #987); the two build.zig options; the four build.zig.zon pins with how build.zig uses each (emsdk pinned but not referenced directly; raylib only in the !ci_mode GUI targets; zig_hdc and zig_golden_float as the modules the library imports); the submodule as a second, unpinned reference the build does not read; the seven profiles of the manifest with what is measured for each (headless and web measured by CI, native unbuilt, fpga/training/network external); the untracked outputs; fourteen tracked files a generator writes, each with its generator and its inputs (.trinity/registry.json, .trinity/mcp_schemas.json, the website's shared-core, universe-atlas, the six spec catalogs, the two viewport files and the vendored manifest); the seven generator output locations; and the receipt policy of the bootstrap/fixture profile: two independent runs, byte-identical, no normalization. Four test blocks.

tools/trinity_build_receipt.py

• graph --trinity-root derives conformance/trinity/build_graph.json from the pinned tree (a modified tracked file is refused; the revision must equal the S01 inventory's): every createModule with its root, every import edge from an artifact or module resolved through variables and aliases to a named module, a package module (dep.module("...")) or an inline module, the packages build.zig references, the profiles, and each generated file with its inputs hashed at the pin (blob hashes for files, tree hashes for directories). Findings: a module root that is not tracked, an unresolved import, a pin that differs, a package pinned but undeclared or referenced but unpinned, a generated file or input missing.
• receipt --runs 2 writes conformance/trinity/bootstrap_receipt.json: the compiler-source revision (the last commit that changed bootstrap/src, Cargo.toml or Cargo.lock), Cargo.lock and t27c hashes, the host, and the hash of what each backend generated from each matrix fixture in every run. Deterministic means identical bytes across runs.
• check recomputes offline that the compiler sources, Cargo.lock, the fixtures and a fresh generation still match the receipt (a changed spec, compiler or dependency invalidates it); with --trinity-root it judges drift in the consumer: a generated file changed while its inputs did not is a suspected hand edit, inputs changed while the file did not is stale, JSON in a generated location that no entry registers (and no other sync claims) is unregistered.
• --self-check plants an unresolved import, a changed fixture, differing runs, a hand edit, a stale artifact and an unregistered file, and requires each to be reported.

Also: tools/trinity_compiler_matrix.py names the compiler-source revision by bootstrap/src (the S02 fixtures live under bootstrap/tests/); same revision, record and seal refreshed. tools/published_figures.py: test-blocks pin 12659 -> 12663.

Measured (2026-09-12)

• Graph at gHashTag/trinity@976df517: 44 named modules, 252 import edges -- 84 to named modules, 152 to package modules (149 to zig-hdc-vsa of zig_hdc, 3 to golden-float of zig_golden_float), 16 to inline modules, 0 unresolved; 0 findings.
• Receipt: 2 runs over 18 fixtures x 4 backends = 72 outputs, 0 differing at compiler sources bff21b85 -- gen-c, gen-rust and gen (Zig) are not byte-deterministic: 1, 3 and 2 files differ between two identical runs #3006's non-determinism does not reach this profile.
• Drift in the consumer at the pin: none (14 generated files, inputs unchanged, no unregistered JSON in the seven locations).
• A fresh clone builds the bootstrap profile: spec-guards builds t27c from a clean checkout on every PR (https://github.com/gHashTag/t27/actions/runs/34686608378 on Add specs/trinity: the Trinity project manifest as .t27 specs (S01 of trinity#988) #3577); the consumer's CI resolves the pinned packages and builds the headless profile (https://github.com/gHashTag/trinity/actions/runs/34678824282).

Verification

python3 tools/trinity_build_receipt.py --self-check                           PASS
python3 tools/trinity_build_receipt.py graph --trinity-root <clone>           0 findings
python3 tools/trinity_build_receipt.py receipt --runs 2                       deterministic
python3 tools/trinity_build_receipt.py check --trinity-root <clone>           OK
python3 tools/trinity_compiler_matrix.py run / check                          OK (record refreshed under the same revision)
t27c typecheck specs/trinity/build_graph.t27   0 errors; seals saved for build_graph and compiler_matrix
check_seal_currency/coverage, specs_generate, duplicate_declarations, assertionless, json_parses, devhome,
documented_commands, conflict_markers, withdrawn_live, published_figures --check, now-entry shape (as PR)   exit 0

What this does not claim

• That the consumer's test graph passes (its exit code is not measured; chore(deps)(deps): bump tokio from 1.52.1 to 1.52.3 #616), that the native, fpga, training or network profiles build, or that the receipt covers more than the compiler and the fixture generation of this repository. Full application-profile reproduction from a clean clone is S12.
• The import graph is read from build.zig with a bracket-aware parser, not by running the build; a !ci_mode guard is recorded, not evaluated.

Do not merge without the owner's approval.

Dmitrii Fedorov (@dmitrii-f-t27)