feat: project scaffold with module graph and CLI stub

[tlkahn]

Summary

• build.zig.zon: package manifest targeting Zig >= 0.16.0
• build.zig: 7-module graph with compile-enforced dependency direction (core, mlxbridge as leaves; engine imports core+mlxbridge+model but NOT chat; http at the top)
• src/cli/main.zig: stub subcommand dispatch (serve/run/pull/list) with usage on bad input
• Per-module test stubs aggregated under zig build test
• Empty subdirs (.gitkeep) for future specdecode, constrain, handlers, cmd, fixtures

Closes #2

Test plan

• zig build produces zig-out/bin/mlxd
• ./zig-out/bin/mlxd serve / run / pull / list each exit 0
• ./zig-out/bin/mlxd (no args) and unknown commands exit 1
• zig build test passes all 7 module tests
• Dependency enforcement verified: adding @import("chat") to engine/root.zig fails with no module named 'chat' available within module 'engine'

🤖 Generated with Claude Code

https://claude.ai/code/session_018JYKbyZSBQmhyVyKpPEXpH

---

Learning tip: why writeAll in src/cli/main.zig looks like raw syscalls

fn writeAll(fd: std.posix.fd_t, bytes: []const u8) error{WriteFailed}!void loops on std.posix.system.write and switches on std.posix.errno(rc) directly, which reads more like C than idiomatic Zig. This is deliberate, not an oversight, and follows from how Zig 0.16 restructured I/O ("Writergate"):

• std.debug.print still exists but its doc comment says it "writes to stderr, ignoring errors" and calls itself a low-level debugging primitive. Review finding M0 Skeleton: build system, module graph, vendored deps, CI #1 on this PR was specifically about swallowing write errors, so an API that swallows them by design can't satisfy it - it's also meant for debugging output, not user-facing CLI output.
• The std.Io interface is the idiomatic 0.16 way to do buffered, error-propagating I/O (there's no more ambient std.io.getStdOut().writer()). But an Io instance is only available if main accepts the full std.process.Init. This scaffold's main intentionally takes std.process.Init.Minimal (just args/environ, no I/O runtime) to keep the stub binary free of runtime machinery it doesn't need yet.
• std.posix.write, the mid-level wrapper that used to retry on EINTR for you, was removed in 0.16. What's left at that layer is the raw std.posix.system.write syscall plus std.posix.errno for classifying the result.

Given Init.Minimal plus the "don't swallow write errors" requirement, the current writeAll is essentially reimplementing the ~8 lines std.posix.write used to provide. It's expected to be temporary: once the CLI does real work (serve, run), main will need the full std.process.Init anyway, and switching to init.io with proper std.Io writers at that point should let this helper be deleted entirely.