feat(graph): compile apple_library through starlark rule impl

Summary

• Move apple_library build logic out of Rust shell-script placeholders into a starlark rule impl declared in crates/once-frontend/prelude/apple.star. The impl composes a real xcrun-driven swiftc -emit-library -static -emit-module command line through native globals (xcrun_swiftc, apple_triple, declare_output, run_action) and returns a provider dict.
• Add the analysis layer in once-frontend that evaluates a rule impl per target with a ctx dict (label, typed attrs, glob-expanded srcs, dep providers, build_dir), collects the declared actions through a thread-local store, and exposes them as DeclaredActions. State threading uses a thread-local instead of Evaluator::extra because the workspace forbids unsafe (the latter requires deriving ProvidesStaticType).
• Add the analysis driver in once-cli that walks deps for impl-bearing rules, converts each DeclaredAction into a once_core::Action with an input_digest composing the swiftc identity, source content digests, and dep action digests, then executes via run_with_cache. The other apple rule kinds (apple_framework, apple_application, apple_test_bundle) keep their existing placeholder scripts; a small RULES_WITH_IMPL list gates the new path.
• Add a fixtures/apple_library/ workspace with AppCore and Greeter (the latter imports the former), plus four new shellspec cases (compile, recursive dep build, cache hit, dep-change invalidation) gated on xcrun availability. Update docs/guide/apple-graph.md with the rule-impl ctx surface and note the planned MCP-for-agents follow-up.

Testing

• mise exec -- cargo test --workspace
• mise exec -- cargo clippy --workspace --all-targets -- -D warnings
• mise exec -- cargo fmt --all -- --check
• mise exec -- cargo build --release
• mise exec -- shellspec
• Manual end-to-end on macOS: built apps/ios/AppCore and apps/ios/Greeter from the fixture; confirmed AppCore.a is a real current ar archive random library, Greeter resolves import AppCore through the -I search path on the dep’s swiftmodule dir, cache hits on rebuild, and dep-source change invalidates the parent cache slot.

No GitHub comments yet.