feat(bindings): generate Gateway bindings outside the source tree

[Mathih13]

Gateway bindings are committed generated code. Schema changes require large mechanical diffs and manual preparation.

Add lyracore bindings to generate private Rust bindings under .lyracore/generated/gateway/. It checks source and output hashes, prepares a complete replacement, and preserves the previous output if generation fails. bindings --check gives Cargo a read-only freshness check. dev up prepares bindings before its Gateway build. The Loot Roll upgrade check now reads the prepared schema instead of a committed file marker.

Schema extraction and CLI publishing use the checkout Cargo configuration for Rust flags.

Core integration: LyraCoreProject/LyraCore#689. Merge this CLI change first.

What you verified

• cargo test -- --test-threads=1: 801 passed, 0 failed.

• cargo +1.85 check --locked: passed.

• Installed the pinned CLI through Core's shim and checked command argument handling.

• Generated 1,184 Rust files with the real SpacetimeDB tools. The schema reader found all 289 tables, including the Loot Roll receipt.

• Checked source edits, linked Packages, missing output, failed replacement, and version mismatch through the process runner and filesystem.

• Adversarial review found that source directories named target could escape the freshness check. Removed the exclusions and added a regression that failed before the fix. An independent final review found no remaining material objections.

• Deploy scripts CI passed at final head ca736690.

What you did NOT verify

No macOS or live Realm verification. Strict CLI Clippy still reports two existing findings in unchanged code: empty_line_after_doc_comments in src/project.rs and single_element_loop in src/cmd/import.rs.

Model: GPT-6-Astra. Harness: Codex in T3 Code.

[Mathih13]

Adversarial review found one cache defect: Rust source directories named target could escape the freshness check. Fixed in ca73669 with a regression that failed before the fix. The independent final review found no remaining material objections.

All 801 CLI tests and the Rust 1.85 check pass. Core installed this pin, generated the bindings, and passed its Gateway check. Deploy scripts CI also passed. The two pre-existing Clippy findings and untested macOS behavior remain documented above. Ready to merge before Core #689.