A component can't build a frontend: the artifact is the git tree, and deploy only runs uv sync #86

Problem

Found while deploying Abecra's staging (Cloudfall's customer zero) on 2026-10-19. Abecra is a Python API plus a Vite web app in one repository. Cloudfall can ship the API but not the web build:

• artifact build (engine/src/cloudfall_engine/artifact.py) clones the repository at a ref and tars the source tree (or repository.subdirectory). No build step runs, so web/dist/ is never in the artifact
• cloudfall_deploy (engine/ansible/roles/cloudfall_deploy/tasks/main.yml) asserts runtime.packageManager == "uv" and materializes the release with uv sync; nothing else runs on the server
• component.schema.json accepts runtime.type: node | pm2 and packageManager: npm | pnpm | yarn, and ROADMAP M4 says "native Python and Node builds", but the deploy role refuses anything that is not uv. The schema promises more than the engine does

The workaround is a side script in the fleet repository that clones the same commit, runs pnpm install && pnpm build, rsyncs dist/ to /srv/apps/<app>/web/releases/<sha>, flips its own current symlink, and only then runs cloudfall deploy. That second release tree has no digest check, no receipt, no rollback with the API release, and can drift from it (the API's current and the web's current are switched by different tools).

Proposal

A declared build step that runs on the controller before packaging, whose outputs go into the same artifact:

spec:
  build:
    - workingDirectory: web
      command: [pnpm, install, --frozen-lockfile]
    - workingDirectory: web
      command: [pnpm, build]
  artifact:
    include: [web/dist]   # build outputs kept even if gitignored

• Runs inside the clean checkout artifact build already makes, with a declared toolchain (node version, package manager) checked like required_tools; a missing tool fails with a typed error before cloning
• Build outputs land in the tarball, so the existing digest, receipt, symlink switch and rollback cover them unchanged
• The ArtifactMetadata records the build steps and toolchain versions that produced it
• Separately: until Node runtimes deploy, component.schema.json should reject runtime.type: node | pm2 and the non-uv package managers instead of failing in the role (or the docs should say they are reserved)

Alternatives

• Keep frontends outside Cloudfall (a CDN or a side script): this is what Abecra does now, and it splits one release into two unrelated rollouts
• A separate static component kind with its own artifact: cleaner for SPAs with no backend, but two artifacts for one commit still need a joint rollback

Acceptance

• A component declaring a pnpm build step: artifact build --ref <sha> produces a tarball containing web/dist/, and its metadata lists the steps
• cloudfall deploy of that release puts web/dist/ under releases/<release>/; cloudfall rollback restores the previous release's web build with the API
• A build step that exits non-zero fails artifact build with a typed error and writes no artifact
• cloudfall config validate on a component with runtime.type: node either deploys it or fails validation; it never passes validation and fails in the role