[shipmill-romamo]

Spec for #86

• Components may declare controller-side build steps (spec.build, argv lists) with a spec.buildTools minimum-version toolchain checked before cloning
• Outputs listed in spec.artifact.include are packaged even if gitignored; with a build, the archive is the git-tracked files plus those paths, so node_modules/ stays out
• A failed tool check, step or missing include exits ARTIFACT_BUILD_FAILED with a typed code and writes no artifact; Artifact metadata records the steps and tool versions
• Build steps run on the controller with a reduced environment (no cloud tokens or SOPS keys); deploy and rollback cover the build output unchanged
• cloudfall config validate refuses non-Python or non-uv runtimes with component_runtime_unsupported, and the Render importer stops writing Node components; Node runtimes on the server stay a separate feature

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: do you approve this spec as written? Merging a spec is its approval (the spec gate), so shipmill holds it for your review instead of merging it on green CI.

1. Approve (recommended once you've read it): merge it yourself, or reply "1" and shipmill merges it on the next tick, then splits it into build issues and starts the build
2. Request changes: reply or review with what to change; shipmill revises the spec in this PR and asks again
3. Refuse: close the PR; the issue reads SPEC_REFUSED and triage decides again (postpone or won't fix)

Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.