feat: eliminate deps/hyperlight-js git clone

[simongdavies]

Replace the manual git clone of hyperlight-js with Cargo's built-in git dependency resolution. The runtime's Cargo.toml now uses a git dep on hyperlight-js-runtime, and the NAPI addon (js-host-api) is built from Cargo's checkout at ~/.cargo/git/checkouts/ with a symlink at deps/js-host-api for npm file: dependency resolution.

Changes:

• Cargo git dep for hyperlight-js-runtime (was path dep to clone)
• HYPERLIGHT_CFLAGS resolved via cargo metadata + Node.js one-liner
• Justfile: resolve-hyperlight-dir discovers checkout, builds NAPI addon, creates symlink (no more fetch-hyperlight/git clone)
• package.json: file:deps/js-host-api (was file:deps/hyperlight-js/...)
• Scripts/tests: all paths updated to deps/js-host-api
• extract-hyperlight-builtins.ts: uses cargo metadata to find source
• Removed: jq dependency, build-with-runtime alias, dead PWD variable
• Docs: all clone references removed, setup descriptions updated
• Docker/CI: COPY path and comments updated for symlink pattern

[Copilot]

Pull request overview

This PR removes the need to manually git clone hyperlight-js by switching the runtime to a Cargo git dependency and re-pointing Node/Vitest/Docker paths to a deps/js-host-api location (backed by a symlink to Cargo’s git checkout).

Changes:

• Switched hyperlight-js-runtime from a local path dependency to a git dependency in the sandbox runtime crate.
• Updated Node scripts and Vitest tests to import/use deps/js-host-api instead of deps/hyperlight-js/....
• Refactored Justfile setup/build flow to discover Cargo’s checkout, build the NAPI addon, and create the deps/js-host-api link; updated docs and Dockerfile accordingly.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/sandbox/runtime/Cargo.toml	Uses a git dependency for hyperlight-js-runtime.
Justfile	Removes git-clone flow; discovers Cargo checkout, builds NAPI addon, and symlinks deps/js-host-api.
package.json	Points @hyperlight/js-host-api to file:deps/js-host-api.
package-lock.json	Updates lock entries for new local file dependency path.
tests/hyperlight-host-module.test.ts	Updates import path to deps/js-host-api/lib.js.
tests/fetch-binary.test.ts	Updates import path to deps/js-host-api/lib.js.
scripts/build-binary.js	Updates hardcoded paths for .node and lib.js to deps/js-host-api.
scripts/extract-hyperlight-builtins.ts	Uses cargo metadata to locate hyperlight-js-runtime source in Cargo’s checkout.
Dockerfile	Copies deps/js-host-api instead of the previously cloned path.
docs/DEVELOPMENT.md	Updates setup instructions to remove clone wording and use just commands.
README.md	Updates just setup description to remove clone wording.
CLAUDE.md / .claude/CLAUDE.md / .github/copilot-instructions.md	Updates setup descriptions to remove clone wording.
.github/workflows/pr-validate.yml	Updates Docker build comment to reflect symlink-based deps.
.dockerignore	Removes now-obsolete explicit ignore entries for old deps paths.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.