Day 5 (Rails slice): real Layer 2 via bin/rails routes

[dadachi]

Summary

Fills the runLayer2 stub with a real implementation for Rails. Strategy: bin/rails routes boots Rails fully (loads gems, resolves the class graph, compiles routes) and exits. No server spawn, no DB churn, no background processes.

How it works

Three subprocess steps, each auto-wrapped with mise exec -- when mise is on PATH:

1. bundle check — skip fast-path if gems satisfied
2. bundle install — only if check fails (first run or Ruby version change)
3. bin/rails routes — the Layer 2 assertion; exit 0 = pass

Why mise

Node's spawn doesn't trigger mise's directory-scoped Ruby auto-switching. Without mise exec, the subprocess inherits the agent's default Ruby — may not match the generated project's .ruby-version — and bundler hard-fails. With mise exec, mise reads the .ruby-version from the subprocess's cwd and resolves correctly. If mise isn't installed, the wrapper falls back to a direct command (agent logs still report what was actually run).

Type reshape

• Layer2Input — dropped healthPath, added timeoutMs (default 5 minutes).
• Layer2Result — dropped port and healthStatus (we're not booting a server). Added command, exitCode, durationMs. stderrTail is only emitted on failure.

Perf on clinic-queue (freshly generated, clean gem cache)

Scenario	Duration
Cold (full bundle install)	23.6s
Warm (bundle check passes)	1.3s

Warm pace is demo-speed — well within the 20-second beat-5 budget.

Test plan

• npm run ci — 5/5 green
• Cold Layer 2 run against ./out/clinic-queue/rails — pass: true, exitCode: 0, 23.6s
• Warm second run — pass: true, 1.3s
• iOS + Android Layer 2 — separate PRs (needs xcodebuild + ./gradlew wrappers)
• Wire Layer 2 into the judge sub-agent — judge currently stubs all three layers; real integration is the next PR

What's not in this PR

• iOS Layer 2 — would use xcodebuild -scheme <Slug> -destination '...iPhone 17...' build (~60-90s fresh, faster on rebuild)
• Android Layer 2 — would use ./gradlew assembleDebug (slow first run, fast on rebuild)
• Judge integration — currently runJudge stub doesn't invoke runLayer1/2/3. Real integration involves passing domain.slug + worker outputs into the judge.