feat: implement Ghidra adapter and Nix integration

tests/adapter_contract.rs

@@ -0,0 +1,48 @@
+#![allow(clippy::expect_used)]
+#![doc = "Java dispatch, protocol-bound, and capability-surface regressions."]
+
+use std::{collections::BTreeSet, fs, path::PathBuf};
+
+use ghidra_cli::operation::OPERATIONS;
+
+fn root(relative: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(relative)
+}
+
+#[test]
+fn java_dispatch_matches_only_worker_owned_registry_operations() {
+    let dispatch = fs::read_to_string(root("java/dispatch.txt")).expect("read Java dispatch");
+    let java: BTreeSet<&str> = dispatch
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.starts_with('#'))
+        .collect();
+    let rust_worker: BTreeSet<&str> = OPERATIONS
+        .iter()
+        .map(|descriptor| descriptor.operation.as_str())
+        .filter(|operation| *operation != "clean")
+        .collect();
+    assert_eq!(java, rust_worker);
+    assert!(!java.contains("clean"));
+}
+
+#[test]
+fn java_source_has_protocol_bounds_and_no_egress_or_mutation_surface() {
+    let source = fs::read_to_string(root("java/GhidrAdapter.java")).expect("read adapter");
+    assert!(source.contains("MAX_REQUEST_BYTES = 1_048_576"));
+    assert!(source.contains("MAX_RESPONSE_BYTES = 268_435_456L"));
+    for forbidden in [
+        "ServerSocket",
+        "HttpServer",
+        "java.net.",
+        "setName(",
+        "startTransaction(",
+        "runScript(",
+        "executeScript(",
+    ] {
+        assert!(
+            !source.contains(forbidden),
+            "forbidden Java surface: {forbidden}"
+        );
+    }
+}