feat(cli): add system onnxruntime-node binding override

[PieterPel]

Summary

Adds the system ONNX Runtime binding override support discussed in PR #589, updated for current main by keeping only the still-relevant pieces. This allows GitNexus to use a system-provided onnxruntime_binding.node via GITNEXUS_ORT_BINDING_PATH, and wires it into both embedder entry points.

Motivation / context

This is a follow-up to the closed PR: #589
Maintainer requested a fresh PR if still relevant. Since upstream already added the HF cache-dir work, this PR only carries forward the ONNX binding override part that remains missing.

Areas touched

• gitnexus/ (CLI / core / MCP server)
• gitnexus-web/ (Vite / React UI)
• .github/ (workflows, actions)
• eval/ or other tooling
• Docs / agent config only (AGENTS.md, CLAUDE.md, .cursor/, llms.txt, etc.)

Scope & constraints

In scope

• Add loader that redirects onnxruntime_binding.node to a user-specified absolute path.
• Wire override into both core embedder initialization paths:
• gitnexus/src/core/embeddings/embedder.ts
• gitnexus/src/mcp/core/embedder.ts
• Document usage in gitnexus/README.md under “System ONNX Runtime Binding (Advanced)”.

Explicitly out of scope / not done here

• Re-adding cache-dir configuration work from old PR [cli] Add system onnxruntime-node binding overrid #589 (already covered upstream).
• Any changes to embedding model behavior or selection logic.
• Any fix for LadybugDB/native test environment issues.

Implementation notes

• Uses a guarded one-time patch of Node module resolution to reroute requests ending with onnxruntime_binding.node.
• Validates that GITNEXUS_ORT_BINDING_PATH is absolute and exists before applying override.
• Behavior remains unchanged unless the env var is set.

Testing & verification

• cd gitnexus && npm test
• cd gitnexus && npm run test:integration (if core/indexing/MCP paths changed)
• cd gitnexus && npx tsc --noEmit
• cd gitnexus-web && npm test (if web changed)
• cd gitnexus-web && npx tsc -b --noEmit (if web changed)
• Manual / Playwright E2E (note environment — see gitnexus-web/e2e/)

Commands run

# containerized run used for parity (node:20-trixie)
podman run --rm --platform=linux/amd64 \
  -v "$PWD":/app \
  -w /app/gitnexus \
  node:20-trixie bash -lc \
  "apt-get update -qq && apt-get install -y -qq python3 make g++ build-essential pkg-config git && npm ci && npx tsc --noEmit && npm test"

# targeted regression check on branch after fixture cleanup
podman run --rm --platform=linux/amd64 \
  -v "$PWD":/app \
  -w /app/gitnexus \
  node:20-trixie bash -lc \
  "apt-get update -qq && apt-get install -y -qq python3 make g++ build-essential pkg-config git && npm ci --ignore-scripts && npx vitest run test/integration/pipeline-graph-golden.test.ts"

Notes on results

• npx tsc --noEmit: passed.
• Full npm test run in container reports existing unrelated failures in this environment.
• pipeline-graph-golden was initially failing due fixture pollution (AGENTS.md, CLAUDE.md, .gitignore) and now passes after cleaning fixture files.
• mcp/server-startup failure reproduces on upstream/main in this environment too (native @ladybugdb/core load issue), indicating it is not introduced by this PR.

Risk & rollout

• Low risk, opt-in behavior only.
• No migrations required.
• Default runtime behavior unchanged when GITNEXUS_ORT_BINDING_PATH is unset.

Checklist

• PR body meets repo minimum length (workflow may label short descriptions)
• If AGENTS.md / overlays changed: headers, scope block, and changelog updated per project conventions
• No secrets, tokens, or machine-specific paths committed

[vercel]

@PieterPel is attempting to deploy a commit to the NexusCore Team on Vercel.

A member of the Team first needs to authorize it.