build(forgebox): rebuild base template from LuCLI template so box install boots clean

[bpamiri]

Summary

KEYSTONE of the ForgeBox/CommandBox path-repair campaign. The published wheels-base-template ForgeBox package was broken end to end: a raw box install produced an app that box server start could not boot, and the artifact had drifted from what wheels new produces.

Per the locked maintainer decision (Peter, 2026-06-12), the base template is now regenerated from cli/lucli/templates/app/ — the single source of truth (the canonical wheels new output) — instead of the repo-root demo app. CommandBox-only build artifacts (server.json, box.json, README.md, the base .gitignore, .mcp.json, .opencode.json) are layered on top; these are the CommandBox equivalents of the LuCLI lucee.json / rewrite.config / _env that wheels new users get.

What changed

• tools/build/scripts/prepare-base.sh — sources app/config/db/public/tests/vendor from the LuCLI template (auto-drops repo-only demo cruft); substitutes the {{appName}}/{{datasourceName}}/{{reloadPassword}}/{{luceeAdminPassword}} and legacy |appName|/|cfmlEngine|/… placeholders to working defaults at BUILD time (scoped to config/server/env/layout — app/snippets/*.txt code-gen templates ship verbatim); translates _env → env.example; generates the default Main.cfc + app/views/main/index.cfm exactly as wheels new does post-copy.
• tools/build/base/.gitignore — no longer excludes /db/**; only generated *.sqlite/*.db are ignored so db/ (with db/.keep) ships.
• tools/build/base/server.json — hardcoded sane defaults (name=Wheels, cfengine=lucee); substitution is now a belt-and-suspenders safety net.
• tools/build/base/box.json — fixed format script paths for the 4.0 app/ layout, simplified postInstall, de-duped keywords.
• tools/build/base/README.md — corrected dependency from ^3.1.0 to 4.0.3; documents the box-install path + CLI-first recommendation.
• Removed tools/build/base/config/{app.cfm,settings.cfm} — these now come from the LuCLI template (so set(useUnderscoreReferenceColumns=true), the env("WHEELS_RELOAD_PASSWORD","") reload pattern, and current guides.wheels.dev doc links all flow from the single source).

Defects fixed

• ForgeBox wheels-base-template ships unsubstituted |placeholders| — box server start fails out of the box #3173 — published artifact carried literal |cfmlEngine|/|appName|/|datasourceName|/|reloadPassword| placeholders that only the dead CommandBox flow ever substituted; box server start died with "Invalid slug detected". Now substituted at build time → zero |tokens|/{{tokens}} in the published artifact.
• wheels-base-template package omits the db/ directory — tools/build/base/.gitignore /db/** strips it at publish #3174 — tools/build/base/.gitignore /db/** caused CommandBox package publish to strip db/ from the zip. Fixed → db/ ships with db/.keep.
• Align the ForgeBox wheels-base-template with the LuCLI wheels new template (single source of truth) #3176 — demo cruft (ProcessOrdersJob.cfc, ApplicationProxy.cfc, index.bxm, dev /cli + /modules mappings), stale 3.1.0 doc links, README ^3.1.0 dep, and the missing useUnderscoreReferenceColumns=true — all resolved by sourcing from the LuCLI template + the README fix.

Verification (CommandBox docker, CommandBox 6.3.3 / Lucee 7.0.4.34)

Before (current prepare-base.sh output): placeholders present, box server start → "Invalid slug detected" on |cfmlEngine|; db/ stripped on publish; demo cruft + 5 /cli mappings; no useUnderscoreReferenceColumns; 3.1.0 links.

After (clean pipeline, zero manual edits):

• box install exit 0 → wheels-core auto-pulled to vendor/wheels/
• box server start boots Lucee 7.0.4.34, profile Wheels, webroot public
• GET / → 200 "Welcome to Wheels" page
• /wheels/info → 200, /wheels/routes → 200 (dev)
• Clean URLs: dropped a Widgets controller → /widgets and /widgets/index route to the app layout; /nonexistentcontroller → 404 (proves routing is real)
• db/ present (.keep + .gitignore)
• tools/ci/smoke-env.sh reload-gate probes PASS (reload-unauthenticated-refused and reload-wrong-password-refused both refused, not 302). The wheels-info-clean-404 and root-no-trace-markers probes note dev-expected behavior (info page + debugbar render only in development).

No cli/ paths modified (the LuCLI template was read-only as the source of truth).

Fixes #3176, #3173, #3174

🤖 Generated with Claude Code