[build-tools][steps] Load composite function catalogs for hook steps

[sswrk]

Why

Local composite functions can be referenced from hook steps (uses: ./...), but build-tools only builds the composite catalog from job steps.

How

• Steps-based jobs: eager catalog loag from job steps, pass a lazy loadCompositeFunction loader so hook composites load only when their anchor runs
• Native jobs: load only from wrapped anchors
• Warn and skip for registered hook keys whose anchors never appear

Test Plan

Added unit tests.

[linear-code]

ENG-22387

[codecov]

Codecov Report

❌ Patch coverage is 98.14815% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 62.43%. Comparing base (1b7a876) to head (ca5c2ca).

Files with missing lines	Patch %	Lines
packages/steps/src/StepsConfigParser.ts	97.30%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4063      +/-   ##
==========================================
+ Coverage   62.40%   62.43%   +0.03%     
==========================================
  Files        1009     1009              
  Lines       45699    45735      +36     
  Branches     9615     9621       +6     
==========================================
+ Hits        28513    28548      +35     
- Misses      15723    15724       +1     
  Partials     1463     1463              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[hSATAC]

Overall this looks good to me, and the native/steps split makes sense. I left a couple of non-blocking inline comments on things I wasn’t sure were intentional.

One separate follow-up: eas workflow:validate only checks composites in job.steps, so references from hooks or defaults.hooks could pass validation and then fail on the worker. Not blocking this PR, but worth tracking.

[sswrk]

One separate follow-up: eas workflow:validate only checks composites in job.steps, so references from hooks or defaults.hooks could pass validation and then fail on the worker. Not blocking this PR, but worth tracking.

Thanks for thinking about everything. This is coming in the next PR, I'm also looking into reducing the duplication between build-tools and eas-cli.

[hSATAC]

The lazy loader addresses what I raised last time, and the rejectingLoader() test covers it. Removing hooks from buildCompositeFunctionCatalogAsync also resolves my other comment.

I left one blocking comment in jobHooks.ts about the hook error messages regressing from main. The other three are non-blocking.

[github-actions]

🤖 AI code review

Decision: Approve with comments

Overall PR risk: Medium. The change modifies existing hook parsing and composite loading behavior. The affected surface is build hook execution for steps and native builds. The main reported risk is that an unknown hook key can write terminal control text to build logs.

🟡 Warning (1)

• Unknown hook key can inject terminal control text — packages/steps/src/StepsConfigParser.ts:216 (security) · id:cdc3a52d7fd0
  Confidence: Medium — the hook key is logged without sanitization.
  Impact if shipped: Medium — build log output could be spoofed.
  Suggested remediation: Strip or escape ANSI and control characters before logging the hook key.

  Evidence and reasoning

  hooks accepts arbitrary string keys. A PR-controlled workflow can set an unknown hook key with ANSI or control characters.

  parseHookKey returns null for that key. The parser then writes the raw key to the logger.

  Build logs display logger text. A control sequence can alter log display or spoof later output.

---

This review is advisory — it never blocks a merge and never auto-approves.

[sswrk]

Re. AI review:

Hook composite errors lose the hook key

Fair, goes hand in hand with #4063 (comment). Addressed: 060c136

Unknown hook key can spoof terminal output

Leaving this out for now, I think it's not really specific to this PR

[hSATAC]

Left one non-blocking inline comment.

[github-actions]

✅ Thank you for adding the changelog entry!