fix(loader): discover stdlib via walk-up + user-share fallbacks (closes #415)

[hyperpolymath]

Summary

Closes #415. Idaptik PR #107 hit this directly: use prelude::{Option, Some, None} failed under affinescript check when invoked from a directory that wasn't the affinescript repo root, because the loader's default config only knew about ./stdlib and the AFFINESCRIPT_STDLIB env var. The workaround was a local enum UndoResult { ... }.

Replaces the hard-coded ./stdlib default with discover_stdlib, which tries in order:

#	Path	Status
1	$AFFINESCRIPT_STDLIB	unchanged — explicit operator override
2	./stdlib	unchanged — in-repo dev
3	walk up from CWD looking for stdlib/prelude.affine	NEW — catches sub-directory invocations
4	<binary_dir>/../share/affinescript/stdlib/	NEW — XDG-style installed location
5	$HOME/.local/share/affinescript/stdlib/	NEW — user-local install

Falls back to ./stdlib (preserves historical ModuleNotFound error) if nothing matches.

Verification (local)

Scenario	Result
in-repo root	./stdlib resolves (unchanged)
in-repo sub-dir	walk-up finds it (NEW)
bare /tmp/ dir, after cp -r stdlib ~/.local/share/affinescript/	user-share finds it (NEW)

What this PR does NOT do

The literal use stdlib::Option parser syntax mentioned in #415's body is a parse error in current grammar (multi-segment stdlib:: prefix not accepted). That's a grammar change deferred as follow-up. The practical Done when criterion — affinescript check succeeds with use prelude::{Option, Some, None} from any directory — is met by this PR.

Roadmap updates

• stdlib roadmap ci: Bump actions/github-script from 7.0.1 to 8.0.0 #5 (cross-file use resolvability) ◑ → ● (follow-up doc PR to flip the row)
• ci: Bump trufflesecurity/trufflehog from 3.92.5 to 3.94.1 #6 (Prelude Option reach) and ci: Bump erlef/setup-beam from 1.17.5 to 1.24.0 #10 (exhaustive imported-enum match) remain ◑ — they depend on the pattern-compiler change rather than the loader fix.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 81 issues detected

Severity	Count
🔴 Critical	4
🟠 High	10
🟡 Medium	67

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v6 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "unknown",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence