build: follow moonbit 0.10.13 and moonbitlang/async 0.22, update all deps

[mizchi]

Summary

The workspace no longer built on the current MoonBit toolchain (0.1.20260915 / moonc 0.10.13): the pinned moonbitlang/x@0.4.40 and bobzhang/toml@0.1.7 fail to compile, and moonbitlang/async changed its HTTP header and cancellation APIs. This PR updates every third-party dependency to its latest release and adapts the code.

Dependency bumps (modules/*/moon.mod, component/moon.mod.json)

package	before	after
moonbitlang/async	0.19.4	0.22.1
moonbitlang/x	0.4.40	0.5.5
bobzhang/toml	0.1.7	0.4.3
mizchi/x	0.2.0	0.6.1
mizchi/zlib	0.4.8	0.4.9
mizchi/simd	0.4.1	0.6.1
mizchi/llm	0.2.2	0.3.2

mizchi/tempfile, mizchi/libgit2 and mizchi/experimental_crypto were already at their latest release.

Code changes

• HTTP headers: @http now keys request/response headers by CaseInsensitiveString. bit keeps plain String maps in its transport-neutral interfaces and converts at the boundary (bit_io_native/http_client_native.mbt, cmd/bit/serve_http.mbt).
• @fs.read_dir returns an ArrayView; the three RepoFileSystem::readdir impls materialise it.
• moonbitlang/core/strconv is empty now; parse_int/parse_int64 come from @string. Dead imports removed.
• async cancellation is no longer an error and cannot be caught, and @async.is_cancellation_error is deprecated (it always returns false). The 123 err if @async.is_cancellation_error(err) => raise err guards are therefore dead code and were removed; the is_being_cancelled() checks stay.
• fragile_catch_all lint (new in this compiler, and fatal under pkf run check's --deny-warn): removed the 60 pure re-raise catch { err => raise err } handlers and moved the three cleanup-in-catch sites (bit cat, bit tree temp dirs, HTTP client close) to errdefer, which also makes them run on cancellation.
• npm CLI payload is now an ES module: moonc emits import statements for the #module("node:fs") FFI bindings that moonbitlang/x 0.5 uses, so the JS build of modules/bit can no longer be required as bit.cjs. It is now copied to npm/bit.mjs; npm/bit.js re-exports it and npm/bin/bit.mjs imports it. package.json exports/files, .gitignore and the pkf task (sync-npm-bit-mjs) follow.
• JS bundle guardrail rebaselined: the tree-shaken minimal lib bundle grew from ~163.5k to 174,458 raw / 40,265 gzip bytes with the new toolchain (same exported surface). Ceilings raised to 180k / 44k in tools/verify-lib-js-treeshake.mjs; the minimal/git-ops ratio guards are unchanged and still hold (0.56 raw, 0.54 gzip vs 0.70).
• CI's setup-moonbit action now pins 0.10.13+cbb11c36f (the old pin cannot compile the new dependency releases).
• moonc stack overflow on the cmd/bit debug build: moonc 0.10.13's link-core pass aborts with an ICE (Error: Stack overflow) when building modules/bit in the debug configuration under the default 8 MiB stack. The same step succeeds with ulimit -s unlimited, and the release build is unaffected. The cmd-native-test job now lifts the limit before building/testing, and AGENTS.md documents it.
• flake.lock refreshed for nix-build: moon-registry advanced to today's mooncakes index (the 2026-08-12 one lacked bobzhang/toml@0.4.3 and moonbitlang/async@0.22.1, failing with attribute '"0.4.3"' missing), and moonbit-overlay to its current HEAD (86fff168, ships the v0.10.13+cbb11c36f toolchain) together with the nixpkgs/treefmt-nix pins from the overlay's own lock. The overlay entry was hashed with nix flake prefetch over git because the sandbox blocks GitHub tarball downloads; the tree has no export attributes, so it is the hash the github: fetcher yields.

Verification

• moon check --deny-warn --warn-list=-27-20-82 (what pkf run check runs) passes for native, js and wasm (also green in CI's test job).
• moon build --target native --release modules/bit succeeds; bit --version runs.
• moon build --target native modules/bit (debug) succeeds with ulimit -s unlimited; the resulting binary passes a smoke run (init, add, two commits, status, log) and real git fsck/git log read the repository cleanly.
• moon test --target native for every non-cmd workspace module plus mizchi/bit/tests: all pass (same loop as the CI full run; also green in CI's test job).
• moon test --target wasm for bit_runtime, bit_diff3, bit_repo, bit_grep: pass.
• moon test --target js -p mizchi/bit -p mizchi/bit_lib: 361/363 pass. The two failures are the ssh-ed25519 signing tests, which shell out to ssh-keygen; it is not installed in this sandbox (ssh-keygen failed with status null). They should pass on the CI runner.
• JS build pipeline reproduced locally (moon build --target js --release for bit_lib and bit, bun bundles, node --test tools/js-build.test.mjs tools/npm-lib.test.mjs tools/npm-cli.test.mjs): 5/5 pass; CI's js-build is green.
• nix flake metadata (with the overlay resolved over git) reports no pending lock changes. A full local nix build was not possible: the sandbox blocks the GitHub tarball downloads the other flake inputs need, so CI's nix-build is the check.
• node tools/check-layers.mjs and tools/check-layer-guards.sh pass.

Not done / follow-ups

• cmd-native-test (cmd-bit-1) fails 2/242 (serve_http_wbtest.mbt:41, grep_wbtest.mbt:1481). The same two tests fail identically on main's last CI run (the Scalable Git server: phases 0–2 (HTTP listener, object store, WAL) #178 merge, old toolchain); they do not touch code this PR changes and are left for a separate fix. See the PR comment.
• Remaining deprecation warnings (@sys.get_env_var → @env, StringBuilder::new() → StringBuilder(), ~1.5k sites) are warning-only and left as is.

🤖 Generated with Claude Code

https://claude.ai/code/session_018UDsHQQ4RZzjsqix2HYGBv

[mizchi]

nix-build is red and I cannot fix it from this session.

The job fails inside the moonbit-overlay dependency resolver with

error: attribute '"0.4.3"' missing
Did you mean one of 0.2.3, 0.4.1, 0.4.2, 0.1.5 or 0.1.6?

flake.lock pins the moon-registry input (the mooncakes index) at a 2026-08-12 revision. It predates bobzhang/toml@0.4.3 (2026-08-16) and moonbitlang/async@0.22.1 (2026-09-16), which this PR now depends on. The moonbit-overlay input is from the same date and will need the newer toolchain as well.

Required fix, to be run by someone with nix available (it is not installed in the sandbox this PR was prepared in, and a git+https lock entry needs a narHash I cannot compute without it):

nix flake update moon-registry moonbit-overlay
nix build   # then push the refreshed flake.lock to this branch

Everything else on this PR is unaffected by the lock file.

---

Generated by Claude Code

[mizchi]

cmd-native-test (cmd-bit-1) is red on main too, with the same two tests.

The shard fails 2/242 on this branch:

• cmd/bit/serve_http_wbtest.mbt:41 "serve --http: a repository resolves under the root": http_resolve_repo("/srv/git", "/acme/app.git") returns /srv/git/acme/app.git, the test expects the .git suffix stripped (/srv/git/acme/app).
• cmd/bit/grep_wbtest.mbt:1481 "grep: command path cases stay compatible": git grep --column -n -o reports column 14 for the second match on a line where git reports 13.

The last CI run on main (run 34554739985, the merge of #178) has the identical failure in the same shard (Total tests: 242, passed: 240, failed: 2, same diff), on the old toolchain. Neither test touches code this PR changes, and no fix exists on any branch yet, so I am not widening this PR with one. Happy to open a separate fix if wanted.

---

Generated by Claude Code

[mizchi]

Update on nix-build: flake.lock is now refreshed on this branch (8930986). moon-registry points at today's mooncakes index and moonbit-overlay at 86fff168 (ships v0.10.13+cbb11c36f), with the overlay's own nixpkgs/treefmt-nix pins mirrored. A full local nix build is still not possible here (GitHub tarball downloads are blocked in the sandbox), so the CI nix-build run on this head is the verification.

---

Generated by Claude Code