Install CodeGraph + Semble, real competitor A/B (B10), and fix embeddings LFS incident

[Eilodon]

Summary

• Wires CodeGraph (colbymchenry, v1.2.0) into .mcp.json via npx -y @colbymchenry/codegraph serve --mcp, zero-setup parity with the existing semble entry (which was already configured/working, no changes needed there).
• Adds B10 — Real Competitor A/B (benchmarks/b10_real_competitor_ab/): spawns real MCP servers for ci, CodeGraph, and Semble and runs the same 4 self-repo tasks used by B4/B6, measuring token cost, tool-call count, and a grep-oracle accuracy check on find_callers.
• New shared infra: benchmarks/lib/generic_mcp_client.py (spawn-agnostic MCP stdio client, reusable beyond ci) and benchmarks/lib/competitor_tasks.yaml (same task IDs as tasks.yaml, mapped to CodeGraph/Semble tool calls).
• Updates benchmarks/README.md (adds B9 "Scaling Curve" as its own planned row, B10 as Implemented) and docs/comparison.md (points to the real measured numbers instead of only public-docs comparison).

Key finding (B10)

On find_callers (collect_source_files), checked against a grep oracle: ci found 2/2 real callers; CodeGraph missed 1/2 — a cross-crate caller reached via a fully-qualified path (ci_core::indexer::pipeline::collect_source_files in a different crate). Semble has no call-graph concept, so that task is marked unsupported for it and excluded from the accuracy comparison (still measured for token/call cost, not hidden, per this repo's "report bad numbers honestly" policy).

Token ratios are reported but explicitly annotated as not a ranking — e.g. CodeGraph's 564x ratio on pre_edit_blast_radius reflects a terser response format (bare symbol list vs ci's source + risk assessment + is_hub + suggested_next), not better compression of the same answer. Full nuance in benchmarks/b10_real_competitor_ab/README.md.

Second commit: embeddings self-heal from an unresolved Git LFS pointer

While running B10, this session's own ci server reported embeddings_status: "failed". Root cause: this container's checkout never ran git-lfs, so the vendored default embedding model (crates/ci-core/assets/potion-code-16m/model.safetensors) was left as a ~130-byte LFS pointer stub instead of real weights — include_bytes! bakes that stub into the binary regardless, so the build "succeeds" and the failure only surfaces at runtime, permanently, with no clear diagnosis.

Fix, researched against how comparable tools (CodeGraph, Serena, model2vec-rs upstream) handle local embedding models, then adapted to ci's own constraints:

• Embedder::load now detects an unusable vendored asset and automatically falls back to a one-time HuggingFace Hub download of the same default model (cached locally afterward), instead of failing forever. This is a functionality/reliability concern, not a privacy one — no code or repo content is ever sent anywhere; only a public static model file is fetched.
• New semantic_search.allow_network_fallback config flag (default true) for anyone who wants semantic search to stay strictly zero-network: with it set to false, an unusable vendored asset reports the new embeddings_status: "offline_unavailable" (a known policy outcome) instead of silently attempting a network call or reporting the more generic "failed".
• Hardened the infra that produced the incident: session-start-build-ci.sh and the documented cloud Setup Script now attempt git lfs pull before building; scripts/mcp-launcher.sh's is_binary_fresh also treats vendored assets as freshness inputs, so a fixed LFS asset invalidates a previously-built stale binary instead of being silently ignored.
• Regression test (default_vendored_asset_is_not_an_lfs_pointer) catches this exact failure mode at test time instead of at first-run in production.

Test plan

• codegraph init ran successfully against self-repo (83 files, 1,628 nodes, 4,423 edges)
• benchmarks/.venv/bin/python benchmarks/b10_real_competitor_ab/run_benchmark.py runs end-to-end and produces the reported numbers
• cargo test --release --workspace — all green (ci-core 388 passed, ci-server 96+2 passed, ci-cli builds clean)
• Manually verified the embeddings fix end-to-end: fresh ci serve process with the rebuilt binary goes downloading → embedding → ready, and search(kind="semantic") returns correct results
• mcp__ci__diff_impact(staged=true) run before both commits — reviewed the one genuinely high-risk-flagged symbol (EmbedStatus::as_str, 21 "callers") and confirmed 20/21 are unrelated textual name-collisions (String::as_str, etc.); the one real caller (embed_status_str) is the intended call site
• Reviewer check: .mcp.json codegraph entry spawns cleanly in a fresh Claude Code / Cursor session

🤖 Generated with Claude Code

---

Generated by Claude Code