feat(frontend,cli): fabrik.star loader, workspace walk, glob, and fabrik build

Summary

• New fabrik-frontend crate embeds starlark-rust 0.13. Built-in target globals: rust_binary, rust_library, rust_test, plus a glob() primitive that expands relative to the package directory.
• load_workspace recursively walks the workspace for fabrik.star files (skipping hidden directories like .git and the .fabrik/ cache) and labels every target as //pkg:name.
• fabrik targets lists every declared target across the workspace; fabrik build <label> emits a rustc action for rust_binary, runs it through the existing action cache, and writes the binary to .fabrik/out/<package>/<name> with cache hits on repeat invocations.
• Standardize on fabrik.star (per package) and *.star (plugin/SDK modules) as the build-file convention. The .fabrik/ cache directory keeps its project-branded name.
• AGENTS.md captures repo-wide conventions: avoid monolith Rust files (top-level reads as a TOC), build-file naming, no em dashes in user-facing text, no roadmap-phase references in code, and the mise exec -- invocation pattern.

Known follow-ups (not in this PR)

• Cache key does not include source file content. Action::RunCommand’s digest is argv + env + cwd + timeout only. Editing a src/*.rs file and re-running fabrik build currently serves a stale cache hit. The next PR should add declared inputs: Vec<WorkspacePath> to Action and digest their content into the key.
• rust_library and rust_test declare but don’t build (fabrik build //x:lib errors with “not yet supported”).
• rust_binary ignores deps; no --extern plumbing yet, so cross-crate builds and any crate using external dependencies (anything in this repo) won’t compile.
• Cache key includes machine PATH and HOME so it’s not portable across machines. Hermetic toolchain handling is later work.
• Only the first srcs entry is treated as the crate root; multi-file binaries with a separate crate_root need a follow-up.

Testing

• mise exec -- cargo test --workspace (all green; 10 new frontend unit tests)
• mise exec -- cargo clippy --workspace --all-targets -- -D warnings (clean)
• mise exec -- cargo fmt --all -- --check (clean)
• mise exec -- shellspec (39/39 examples; 11 new under spec/build_spec.sh and spec/targets_spec.sh)
• Manual end-to-end: scaffolded a hello-world workspace, ran fabrik build //hello:hello, executed the resulting binary, re-ran to confirm cache hit.

No GitHub comments yet.