Add headless engine worker with JSON-lines RPC

.env.example

@@ -0,0 +1,20 @@
+# Copy to .env (never commit .env).
+
+# compose.enhanced.yml (build from source) and compose.image.yml (prebuilt image)
+POB2_PORT=8080
+# 127.0.0.1 = this machine only; 0.0.0.0 = reachable from your network. There is no login, so only expose it
+# on a network you trust (or use compose.tailscale.yml).
+POB2_BIND=127.0.0.1
+# Hostnames/IPs other machines use to reach /mcp (comma-separated); localhost always works.
+POB2_ALLOWED_HOSTS=
+# compose.image.yml only: image to run
+# POB2_IMAGE=ghcr.io/skitty4fingers/pob-enhanced:latest
+
+# compose.tailscale.yml
+# Auth key: https://login.tailscale.com/admin/settings/keys (reusable not needed; state is persisted)
+TS_AUTHKEY=tskey-auth-xxxxxxxxxxxx
+# Your tailnet DNS name: admin console -> DNS -> "Tailnet name", e.g. tail1234.ts.net
+TS_TAILNET=tail1234.ts.net
+TS_HOSTNAME=pob2
+# Optional, e.g. --advertise-tags=tag:pob2 (the tag must exist in your ACL policy)
+TS_EXTRA_ARGS=

.github/workflows/enhanced.yml

@@ -0,0 +1,53 @@
+name: Enhanced (engine, MCP, web)
+on:
+  push:
+    branches: [main, dev, "claude/**"]
+    paths: ["engine/**", "python/**", "web/**", "src/**", "scripts/setup-engine.sh", ".github/workflows/enhanced.yml"]
+  pull_request:
+    paths: ["engine/**", "python/**", "web/**", "src/**", "scripts/setup-engine.sh", ".github/workflows/enhanced.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    runs-on: ubuntu-latest
+    env:
+      PREFIX: ${{ github.workspace }}/.luajit
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Cache LuaJIT runtime
+        uses: actions/cache@v4
+        with:
+          path: .luajit
+          key: luajit-${{ runner.os }}-${{ hashFiles('scripts/setup-engine.sh') }}
+      - name: Build LuaJIT runtime
+        run: |
+          bash scripts/setup-engine.sh --runtime-only
+          echo "$PREFIX/bin" >> "$GITHUB_PATH"
+      - name: Lint
+        working-directory: python
+        run: |
+          uv sync --frozen
+          uv run ruff check src tests
+          uv run ruff format --check src tests
+      - name: Test
+        working-directory: python
+        run: uv run pytest -v
+
+  web:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - run: npm ci
+      - run: npm run build