ci: declare top-level token permissions for CodeQL

CodeQL's actions/missing-workflow-permissions check flagged every job in ci.yml (main lines 19, 85, 94, 121, 162, 254, 271): the workflow had no permissions block, so each job ran with the default (broad) GITHUB_TOKEN.

Audited every job for gh CLI calls, GITHUB_TOKEN/secrets.GITHUB_TOKEN use, PR comments, and artifact upload/download actions - none use any of these. The only secrets referenced are R2 sccache credentials, and the only actions used are actions/checkout, dtolnay/rust-toolchain, mozilla-actions/sccache-action, Swatinem/rust-cache, and the local setup-bun action, all read-only against the repo. So a single top-level 'permissions: contents: read' covers every job; no job needs its own override.

Merge pull request #290 from dekaruntime/claude/integration-console-dds

Integration: console global, .d.ds files, fn hint, default exports (#269#277#279#287)

Fix module_graph test for the FsError-typed fs bridge signature

graph_types_bridge_calls_in_an_imported_package hardcoded fs.read_file's pre-deka#1146 Result<bytes, string> shape; it now returns FsError.

Sync host declaration file for deka 0.53.7-canary-b5228e0 (deka#1146)

Fixes CI's host-decl drift check on dsc#290: the new canary generates deka-host.d.ds with FsError/FsPermission/DirEntry declared alongside the bridge blocks (deka#1145/#1146), and maps unit fs/net/db results to boolean instead of void.

Merge pull request #1147 from dekaruntime/claude/import-meta-runtime-1139

import.meta runtime values, url pointing at the original source file

Resolve dsc for the import.meta e2e tests the way every other one does

The two end-to-end tests in crates/cli/tests/import_meta_runtime.rs were gated behind a test-only IMPORT_META_TEST_DSC env var; without it they returned early and reported as passed ("2 passed ... finished in 0.00s") instead of skipped or failed - the skip-that-looks-green shape this repo already has scar tissue for. CI never set that var, so both tests were silently no-ops in every run since the PR opened.

Drop the custom var and the early return. The spawned cli subprocess now resolves dsc exactly the way every other real-dsc integration test in this directory does (crates/cli/tests/dekascript_run.rs and friends): by inheriting DEKA_DSC from the test process's own environment, which is compiler::dsc::find_cli_dsc()'s first-priority source. CI already sets that (ci.yml installs the pin from scripts/dsc-version to .ci/dsc and exports DEKA_DSC for the cargo test step); deka main now pins 0.53.6-canary-791d178 (deka#1149), which includes dsc#282, so the tests run for real in CI going forward. Locally, whatever the developer has on DEKA_DSC/PATH resolves the same way deka run always does.

With no dsc resolvable at all, deka run fails with its ordinary "dsc is required..." error, which surfaces as an ordinary test failure via the existing assert!(ok, "deka run failed:\n{output}") - never a silent pass.

Evidence (see PR body for full transcripts):

• scripts/ci-install-dsc.sh .ci/dsc installs the pinned dsc locally. DEKA_DSC=.ci/dsc cargo test -p cli --test import_meta_runtime -> both tests pass in 6.3-6.4s (non-zero duration), and a standalone deka run against that same dsc prints the actual asserted import.meta values (original .ds path, not the cache copy; main true/false correctly; resolve() matching; assignment throwing).
• Reverting logical_source_path to identity (the loader's core fix) and rerunning with the same pinned dsc: loose_run_reports_original_source_ not_the_cache_copy fails, asserting the compiled cache path where the original source path was expected.
• Without DEKA_DSC and no dsc on PATH: both tests fail with dsc's own "dsc is required..." message, not a skip.

Pin deka runtime to 0.53.7-canary-b5228e0

Carries deka#1150 (None/Ok/Err printing, rfd#44 'Formatting erased values'), so the console_printable option/result rows no longer need to be expected failures.

Merge pull request #1150 from dekaruntime/claude/console-erased-printing

Console printer: format erased Option/Result per rfd#44

Merge remote-tracking branch 'origin/main' into claude/import-meta-runtime-1139

Merge pull request #1149 from dekaruntime/claude/pin-dsc-791d178

Pin dsc 0.53.6-canary-791d178