Finish the hard parts of the lua makeover

- bundle luarocks source in the panto binary
- bootstrap process (intended for first `panto` run):
  - make ~/.local/share/panto/...
  - write out luarocks sources into it
  - run luarocks to install luv
- new `panto bootstrap` command just runs the bootstrap
- `panto bootstrap --force` removes everything and re-bootstraps
- new `panto lua` command just runs panto's embedded lua

1 files changed, 43 insertions, 0 deletions

diff --git a/src/manifest.zig b/src/manifest.zig
new file mode 100644
index 0000000..b12b5c4
--- /dev/null
+++ b/src/manifest.zig
@@ -0,0 +1,43 @@
+//! Pinned versions of every Lua component shipped with panto: the
+//! upstream Lua language version, the embedded luarocks version, and
+//! the rocks ("batteries") panto requires for its own runtime to work.
+//!
+//! Bumping any of these is a deliberate edit + commit + version bump of
+//! panto itself. Each panto release pins one consistent set; bootstrap
+//! reconciles the installed rocks tree against this manifest on every
+//! startup, installing missing rocks and removing stale ones (per Q5 of
+//! LUA_MAKEOVER.md).
+//!
+//! The Lua and luarocks versions ride in via the `versions` build option
+//! so build.zig stays the single source of truth. The batteries are
+//! pinned here directly because they don't otherwise need to be visible
+//! to the build.
+
+const versions = @import("versions");
+
+pub const lua_version: []const u8 = versions.lua_version;
+pub const lua_short_version: []const u8 = versions.lua_short_version;
+pub const luarocks_version: []const u8 = versions.luarocks_version;
+
+pub const Battery = struct {
+    /// Rock name as published on luarocks.org.
+    name: []const u8,
+    /// Pinned rockspec version, e.g. `"1.52.1-1"`. luarocks uses these
+    /// MAJOR.MINOR.PATCH-REV strings throughout — we pass them straight
+    /// through to `luarocks install`.
+    version: []const u8,
+};
+
+/// Rocks installed automatically at bootstrap. Compiled into the panto
+/// binary; users do not configure this list.
+///
+/// We deliberately ship the smallest viable set: luv is the only
+/// runtime dependency — it provides libuv's event loop, which panto's
+/// coroutine scheduler drives, and gives extension authors a single
+/// rich async I/O surface. Anything else (coro-* helpers, lua-cjson,
+/// lpeg, etc.) is the user's responsibility, installable via
+/// `panto lua -e 'arg[0]="luarocks"; require("luarocks.cmd").run_command(...)'`
+/// or, eventually, a higher-level `panto rocks install` subcommand.
+pub const batteries: []const Battery = &.{
+    .{ .name = "luv", .version = "1.52.1-0" },
+};