feat(discord): connector pilot for the Sage seat, reviewed candidate (#1509)

Zero-dependency Discord connector under packages/discord: binding
validation, REST and gateway clients, pi engine adapter, journal with
append-only inbox, outbox, admissions and notices, and a run.lock
ownership record {pid, start, boot} whose identity is checked three ways
and whose cleanup is gated by STOP. CLI check|run|stop|unlock via
scripts/discord.sh; offline suite scripts/test-discord.sh (28 checks,
87 node tests).

Reviewed by rev-code-02 on #1509 over nine rounds; approved exact tree
4e0feb6758c0a7e4a71483912a8e0d3e3ec95aef at comment 26170. Corrections
(1) to (12) recorded in BUILD-LOG. No listener started, no token read,
no Discord write; the live pilot follows this commit per the brief.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

scripts/discord.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# `scripts/discord.sh check|run|stop|unlock <binding>`: the Discord connector for
+# one seat on one server. See packages/discord/README.md. The binding lives
+# at <dataRoot>/discord/<binding>.json (0600, never committed); the token
+# stays in the seat's private secrets directory and is read at runtime only.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+exec node "$REPO/packages/discord/src/cli.mjs" "$@" --repo "$REPO"

scripts/test-discord.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Offline suite for packages/discord (issue #1509). No token, no network,
+# no model: every test drives the connector with a fake gateway, fake REST,
+# fake pi and a disposable data root.
+#
+#   scripts/test-discord.sh            full run
+#   NO_COLOR=1 scripts/test-discord.sh plain output
+set -uo pipefail
+cd "$(dirname "$0")/.."
+
+SANDBOX="$(mktemp -d)"
+trap 'rm -rf "$SANDBOX"' EXIT
+PASS=0
+FAIL=0
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
+check() {
+    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $1"; else FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $1"; fi
+}
+
+echo "toolchain: node $(node --version)"
+echo
+
+# --- syntax ---
+for f in packages/discord/src/*.mjs packages/discord/tests/*.mjs scripts/discord.sh; do
+    case "$f" in
+        *.sh) bash -n "$f" >/dev/null 2>&1 ;;
+        *) node --check "$f" >/dev/null 2>&1 ;;
+    esac
+    check "syntax: $f" $?
+done
+
+# --- no dependencies, no secrets in the package ---
+node -e 'const p=require("./packages/discord/package.json"); process.exit(p.dependencies||p.devDependencies?1:0)' >/dev/null 2>&1
+check "packages/discord declares no dependencies" $?
+if grep -rEn '[MN][A-Za-z0-9]{22,}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,}' packages/discord scripts/discord.sh >/dev/null 2>&1; then
+    check "no bot-token-shaped string in packages/discord" 1
+else
+    check "no bot-token-shaped string in packages/discord" 0
+fi
+node -e '
+const b = JSON.parse(require("fs").readFileSync("packages/discord/fixtures/binding.example.json","utf8"));
+const ids = JSON.stringify(b).match(/[0-9]{17,20}/g) || [];
+process.exit(ids.every((id) => id.startsWith("10000000000000")) ? 0 : 1);
+' >/dev/null 2>&1
+check "fixture binding uses placeholder ids only" $?
+
+# --- the fixture validates against the schema ---
+node -e '
+import("./packages/discord/src/binding.mjs").then((m) => {
+  const raw = JSON.parse(require("fs").readFileSync("packages/discord/fixtures/binding.example.json","utf8"));
+  m.validateBinding(raw);
+}).catch((e) => { console.error(e.message); process.exit(1); });
+' >/dev/null 2>&1
+check "fixture binding validates" $?
+
+# --- the seven offline groups ---
+node --test --test-reporter=spec packages/discord/tests/ >"$SANDBOX/node-test.log" 2>&1
+NODE_RC=$?
+check "node --test packages/discord/tests/ ($(grep -E '^ℹ pass' "$SANDBOX/node-test.log" | tr -d '\n' || echo 'summary missing'))" $NODE_RC
+if [ "$NODE_RC" -ne 0 ]; then
+    grep -E '^✖|not ok|Error|error:' "$SANDBOX/node-test.log" | head -40 >&2
+fi
+
+# --- wrapper usage paths ---
+scripts/discord.sh --help >/dev/null 2>&1
+check "scripts/discord.sh --help exits 0" $?
+scripts/discord.sh check >/dev/null 2>&1
+[ $? -eq 4 ]
+check "scripts/discord.sh check without a binding exits 4" $?
+
+echo
+echo "discord suite: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]