pkg: make bootstrap --check validate apt names, and run it on 26.04

--check verified outcomes — binaries on PATH, pkg-config modules — on a box
that already installed everything. It never looked at the APT_* names, which
is the only part that breaks on a clean machine of the wrong release, as R1
just showed. Add a loop over the assembled PKGS array that fails on any name
with no installable candidate (apt-cache policy; no root, no network).
All-missing is treated as stale lists (warn), not 36 bad names.

The bootstrap-script job runs on a 24.04 runner, where the bad name still
resolves, so name validation there checks the wrong archive. Add
bootstrap-script-2604: a real --with-clang install in an ubuntu:26.04
container — the release the project ships on, and the first time the
fuzz-toolchain half of bootstrap is exercised anywhere (CORE had been running
clang++-21 directly). Also pass --with-clang/--packaging to the 24.04 --check
so the optional and M6 names can't rot unnoticed. BRANCH_PROTECTION.md gains
the 2604 row and the stale "when X merges" rows are corrected to "now".

gui/docs/pkg-qa-requests-m1.md R2 + the --with-clang note.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw

.github/workflows/ci.yml

@@ -41,12 +41,38 @@ jobs:
         run: python3 tools/testserver/selftest.py
 
   bootstrap-script:
-    # Keeps tools/bootstrap.sh honest: it must run clean and its --check must pass.
+    # Keeps tools/bootstrap.sh honest on the runner image: it must run clean and its
+    # --check must pass. ubuntu-latest is 24.04; the project ships on 26.04, so this
+    # exercises the 24.04 archive only. bootstrap-script-2604 below is what validates
+    # the package names against the release the project actually targets.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: sudo ./tools/bootstrap.sh --with-clang
-      - run: ./tools/bootstrap.sh --check
+      - run: ./tools/bootstrap.sh --check --with-clang
+      # Cheap: apt-cache only. Validates the M6 packaging names now so they can't rot
+      # unnoticed until M6.
+      - run: ./tools/bootstrap.sh --check --with-clang --packaging
+
+  bootstrap-script-2604:
+    # The project targets 26.04 and GitHub has no 26.04 runner image yet, so the one
+    # automated place bootstrap.sh runs is on the wrong release to catch a name that is
+    # valid on 24.04 and gone on 26.04 — which is exactly how libqt6svg6-dev reached a
+    # contributor's VM (gui/docs/pkg-qa-requests-m1.md R1/R2). Run the real install in a
+    # 26.04 container, with --with-clang: the fuzz toolchain had never been exercised
+    # anywhere (CORE ran clang++-21 directly because it can't sudo).
+    runs-on: ubuntu-latest
+    container: ubuntu:26.04
+    steps:
+      - name: Base tools for checkout
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates git sudo
+      - uses: actions/checkout@v4
+      - name: Full bootstrap on 26.04 (--with-clang)
+        run: ./tools/bootstrap.sh --with-clang
+      - name: Re-verify
+        run: ./tools/bootstrap.sh --check --with-clang
 
   extension-lint:
     runs-on: ubuntu-latest