fix(cli): make type, parse and import errors fatal in `home build` / `home check`

Problem

home build prints type errors under "Type Warnings (continuing)" and still emits a binary; kernel mode skips type checking entirely. A missing import prints a message and the build succeeds. home check passes a file that failed to parse unless HOME_STRICT=1 is set. Sound types mean nothing if unsound programs still ship.

Evidence (origin/main @ d4b219507)

• src/main.zig:3773-3799
• src/main.zig:3761-3771
• src/main.zig:561-566

Scope

• Exit non-zero on any type error, parse error or unresolved import.
• Add an explicit opt-out (--allow-type-errors) for incremental adoption.
• Make strict parsing the default for home check; drop the HOME_STRICT env gate.
• Run the type checker in --kernel builds too (with an allowlist if the kernel corpus needs one).

Acceptance criteria

• home build bad.home (type error) exits 1 and writes no binary.
• A file with a parse error fails home check without any env var.
• import missing fails the build.
• Regression tests for each.

Links

Depends on: #778, #779 Part of #814.

Progress: pushed ddd3b12 (feat(cli): add explicit type-error opt-out (#780)) directly to main.

This extracts the build CLI parser into one focused module, adds the explicit --allow-type-errors option (fatal remains the default), preserves the existing target/output/sourcemap validation, and registers a dedicated test artifact.

Verification: guarded zig build test -Dfilter=build_cli_options -j1 --summary all passed 5/5 tests with a 280 MB peak under the 3,840 MB ceiling.

Issue remains open: the next batch wires type/import failures to a nonzero build exit, makes home check parse failures unconditional, and runs type checking in --kernel mode.

Pushed 1149bd9 (fix(cli): fail builds on invalid programs (#780)) directly to main.

Implemented:

• home check now rejects any collected parse error without HOME_STRICT.
• home build type-checks Home programs by default and returns TypeCheckFailed before code generation/output creation.
• --allow-type-errors is the sole explicit continuation path.
• kernel builds now run the same type checker.
• type checking is initialized with the source path, comptime store, and I/O context.
• unresolved imports are recorded as checker errors instead of being silently discarded.

Verification:

• guarded CLI policy target: 7/7 passed, 172 MB peak.
• guarded type/control-flow target: 45/45 passed, including a bare unresolved-import regression, 331 MB peak.
• no-JSC debug compilation reached src/main.zig but is independently blocked by the pre-existing missing home_rt_no_jsc.Output surface.
• default JSC debug linking was stopped by the unchanged 3,840 MB ceiling at 4,147 MB (host still at 32%); I did not raise or bypass the cap.

Keeping #780 open until executable-level acceptance checks can be run under the memory ceiling.

Completed on main with ddd3b12, 1149bd9, and 755493002.

Final executable-level verification used a freshly built home-debug from zig build debug -Denable_jsc=false -j1 (5/5 build steps, 809 MB guarded peak), then exercised the real CLI under the same supervisor:

• bad type home build: exit 1, no output file
• parse error home check with HOME_STRICT unset: exit 1
• unresolved import home build: exit 1, no output file
• bad type home build --kernel: exit 1, no assembly output
• bad type with explicit --allow-type-errors: exit 0 and output produced

Supporting focused verification:

• build CLI/policy: 7/7 passed, 172 MB peak
• type/control-flow checker: 45/45 passed, 331 MB peak
• no-JSC startup surface: 2/2 passed, 281 MB peak

The default JSC link was not used to evade the memory policy: it was stopped at the unchanged 3,840 MB ceiling. The native-only build is a supported compiler configuration and now has a regression-tested startup surface.