GIT-018 JS: build the wire push-pack in pure JS — drop the keeper spawn

The JS wire push does not build its own pack: shared/wire.js buildPushPack shells to the native keeper upload-pack <store>?/<proj>, driving a full upload-pack negotiation with a spawned keeper just to harvest the packfile. That makes every jab post/jab put over the wire depend on the native keeper binary at runtime (and blocks a push wherever it is absent). The pieces to do it in JS already exist — the git.pack writer bindings, the keeper-store reader (commitParents/readTree/getObject), and jab post's local pack build (fold-commit.writePack). Fix: replace the keeper spawn with a pure-JS thin push-pack — walk the reachability closure (want=tip MINUS have=remote tips) over the JS store and emit via git.pack, no subprocess. Reuse PACK-002's OFS writer for offset-only deltas; keep the packfile fsck-clean on the peer. JS only (be/, via jab). Method: work; sibling GIT-013/GIT-016.

Input

Context

shared/wire.js buildPushPack(localServe, wantSha, haves) (~L393) does io.spawn(KEEPER_BIN, ["keeper","upload-pack", localServe]), drains keeper's advert, sends want/haves/done, and reads the pack after NAK — a native pack build wearing a wire-negotiation costume.
Consumers: verbs/post/post.js pushRemote and verbs/put/put.js pushWire both call buildPushPack before wire.push, so BOTH break without a keeper binary.
The JS already builds packs: the git.pack package (git.pack.ram/over, feed, header, finish), the store reader (getObject/commitParents/readTree), and jab post fold-commit.writePack (a local commit pack) — PACK-002 tracks giving that writer OFS_DELTA.
Fetch is already keeper-independent on the JS side (wire.fetch + ingest); only the push-pack BUILD still delegates to the native binary.

Goals

buildPushPack assembles the push pack in pure JS: compute the object closure reachable from wantSha and NOT from haves, then emit a valid packfile via git.pack — NO keeper spawn, no subprocess.
A jab post/jab put over ssh/http completes with no native keeper binary present; the peer accepts the pack (git receive-pack fsck-clean, unpack ok).
Include the store-anchor blob on a fresh-remote push (GIT-009's WALK_INCL_ANCHOR) so the peer does not fsck missing blob.

Constraints

JS only, be/, run via jab. Do NOT run native be; do NOT open beagle/.
Reuse before add: git.pack writer, the store reader closure walk, fold-commit.writePack, PACK-002's OFS_DELTA encoder. No hand-rolled pack byte-twiddling outside git.pack; no new deps.
Offset-only deltas (OFS_DELTA against an earlier object in the SAME pack), never REF_DELTA (PackLog); a self-contained (non-thin) closure sidesteps thin-pack base fixups if simpler and still correct.
ABC/JS norms: ≤2-line GIT-018 comments, greppable, ticket-coded ≤64-char commit.
Do not regress the wire bucket (push-ssh/push-http/put-force-*) — they must pass with the JS builder AND (as a bridge) still pass if keeper is present.

WIP

Design decisions

Prefer a self-contained closure (send every object reachable from want but not from any have) over a thin pack: correctness first; a thin-pack optimisation (delta vs bases the remote holds) can be a follow-up.
Keep buildPushPack's signature (localServe, wantSha, haves) so pushRemote/pushWire are untouched; swap only the body (spawn → JS walk+emit).

TODOs

T1 — repro: a push with NO keeper on PATH, peer unpack ok + fsck-clean. — test/wire/push-nokeeper (KEEPER_BIN pointed at a non-existent path).
T2 — JS closure walk: want-minus-have over the store reader, dedupe by sha, gitlinks recorded not descended. — landed e42c94e7 (wire.js markReachable).
T3 — emit the pack via git.pack + sha1 trailer; the GIT-009 anchor rides the full tree closure (a committed blob, walked naturally). RAW records this pass — OFS_DELTA stays PACK-002 (noted in emitPack). — landed e42c94e7.
T4 — swap buildPushPack's body to the JS builder; drop the keeper upload-pack spawn. — landed e42c94e7 (signature kept, spawn gone).
T5 — regression: wire bucket (push-ssh/http, put-force-ssh/http) green with keeper ABSENT; fetch/clone unaffected. — push-nokeeper + wire bucket.

Blockers and bummers

Thin-pack vs self-contained: git receive-pack accepts a non-thin pack, so the closure approach is safe; a thin pack needs base bookkeeping against haves — defer unless cheap.
OFS_DELTA correctness is PACK-002's remit; coordinate so the JS writer emits offset-only deltas (a RAW-only pack works but bloats the wire).
Depends on the store reader exposing the full closure (commit→tree→blob); watch for submodule gitlinks (do NOT descend — record the gitlink object only).

Outcome

Landed e42c94e7 ("dont use the native binary for making packs", be/ trunk): shared/wire.js buildPushPack is pure JS — serveReader + markReachable closure walk + emitPack (git.pack.over, sha1 trailer); no keeper spawn. Test test/wire/push-nokeeper.
Deferred (tracked, not cancelled): OFS_DELTA emit — the push pack is RAW (self-contained, non-thin); deltification is PACK-002's remit.
Bonus reuse: GIT-020 261680bf serves fetches with the same markReachable/buildPushPack core (shared/serve.js).