fix(compile): resolve workspace $LOAD_PATH via magma-rubygems (composer double-copy)

[drzln]

Fixes uninitialized constant Pangea::Architectures on the pleme-io-opensource compile

Root cause: pangea-architectures (the composer) exists twice on disk — the gem-cache ArchitectureGem clone (/var/pangea/gems/pangea-architectures-main/) and the template's own _repo clone (the template source is the pangea-architectures repo). The sentinel put _repo/lib on $LOAD_PATH, but compile_template's per-compile purge prefix only covers the gem-cache copy. After the Pangea::Architectures module purge, the _repo/lib $LOADED_FEATURES entry survived → require no-op'd → the constant stayed undefined.

Fix: resolve the workspace Gemfile.lock into a deterministic, dependency-ordered $LOAD_PATH closure via magma-rubygems (resolve_ruby_env_for_roots), so the composer resolves to one canonical copy — the gem-cache clone the purge prefix matches.

Changes

• template_controller::resolve_workspace_load_path — locate sibling Gemfile.lock, parse, roots = PATH-sourced gems (excludes rubygems dev/test gems the image doesn't bundle), CompositeLocator = ManifestLocator(baked) ▸ GemRootsLocator(gem cache). Gated on PANGEA_GEM_MANIFEST: absent ⇒ legacy single-_repo/lib, zero regression. A missing closure gem is a typed MissingGems compile failure, not a deep LoadError.
• flake.nix — emit the baked-gem name→lib manifest (pangeaInputs path-gems + RubyGems-enumerated bundler gems), bake into image, set PANGEA_GEM_MANIFEST.
• owner.rs — widen rubylib validation trusted roots to {workspace base, gem cache, /nix/store}.
• Cargo.toml — branch-pin 14 magma deps to feat/load-path-resolver (revert after magma#1 merges); magma-rubygems non-optional.

Depends on

pleme-io/magma#1 — the resolver primitive (64 tests).

Verification

cargo check --features embedded_ruby green; magma advance f92bacb..dd89751 compatible; gen build regenerated Cargo.build-spec.json.

🤖 Generated with Claude Code