facade: optional view-config resolver contract

[wolfy-j]

What

Adds an optional wippy.facade:resolver contract that lets a consuming application override facade requirement values (css_variables, custom_css, app_title, app_icon, theme_mode, …) at request time — driving the view config from runtime state (settings, per-tenant branding) instead of only static ns.requirement defaults.

Fully backward-compatible: no binding ⇒ no behavior change. With nothing bound the config and CSS-vars handlers return exactly the static-requirement output they do today.

The contract

resolver (kind: contract.definition, namespace wippy.facade) with a single resolve method:

• input: optional context object (reserved; empty {} today)
• output: a map of { requirement_name -> override value string }. Values use the same format as the static requirement default (JSON-encoded for JSON requirements such as css_variables); omitted keys fall back to the static default.

How the handlers use it

theming_helpers gains two functions:

• resolve_overrides() — optionally opens a bound wippy.facade:resolver and returns its {name -> value} map, else {}.
  • Structural gate: "is a resolver bound?" is decided by :implementations() (empty list ⇒ not bound ⇒ {}). This is deliberate — the contract-open sentinel is a plain errors.New with no Kind, so it surfaces as kind=Unknown and can't be distinguished from a real failure by kind. The binding count is the correct signal; no error-string/kind matching.
  • Ambient actor: opened with :open() (no with_actor/with_scope) so the resolver runs as the request's caller.
  • pcall-hardened: the config/CSS endpoints are load-bearing, so every failure path (and any unexpected throw) degrades to {} = static defaults. An absent resolver is silent; a bound-but-failing one is logged.
• requirement(name, overrides) — prefers an override string, else the static wippy.facade:<name> default.

config_handler and css_vars_handler now resolve overrides once per request and route every requirement read through the override-aware getter (the get_req closure over the resolved overrides). The now-unused direct registry require was dropped from both handlers since reads go through theming_helpers.

theming_helpers library entry gains the registry, contract, logger module grants it now needs.

Integration note (consuming app)

The upstream handler security policy is left unchanged (config_read_runtime + content_fs_runtime). A consuming app that wants to actually bind a resolver must grant the config/CSS handlers contract.get / contract.open / contract.call on wippy.facade:resolver (and its binding), e.g. via an app-side policy added to those handlers. Without that grant, resolve_overrides() simply degrades to {} (static defaults) — it never breaks the endpoints. The default upstream policy is intentionally not weakened.

Compatibility

No binding ⇒ resolve_overrides() returns {} ⇒ output is byte-identical to today's static-requirement behavior.

[wolfy-j]

Updated the branch: dropped the :implementations() probe (open() alone suffices — the endpoints degrade to static on any resolver failure, so "unbound" and "errored" need no distinguishing) and removed the now-unused logger.

Facade suite runs offline and passes: cd src/facade/test && wippy run test → 2/2 (config_handler_test, security_policy_test), exit 0.