pkg: make bootstrap --check validate apt names, and run it on 26.04

--check verified outcomes — binaries on PATH, pkg-config modules — on a box
that already installed everything. It never looked at the APT_* names, which
is the only part that breaks on a clean machine of the wrong release, as R1
just showed. Add a loop over the assembled PKGS array that fails on any name
with no installable candidate (apt-cache policy; no root, no network).
All-missing is treated as stale lists (warn), not 36 bad names.

The bootstrap-script job runs on a 24.04 runner, where the bad name still
resolves, so name validation there checks the wrong archive. Add
bootstrap-script-2604: a real --with-clang install in an ubuntu:26.04
container — the release the project ships on, and the first time the
fuzz-toolchain half of bootstrap is exercised anywhere (CORE had been running
clang++-21 directly). Also pass --with-clang/--packaging to the 24.04 --check
so the optional and M6 names can't rot unnoticed. BRANCH_PROTECTION.md gains
the 2604 row and the stale "when X merges" rows are corrected to "now".

gui/docs/pkg-qa-requests-m1.md R2 + the --with-clang note.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw

tools/bootstrap.sh

@@ -146,6 +146,36 @@ need_cmd() {
     fi
 }
 
+# Every apt name this script would install must resolve to an installable candidate on
+# THIS release. The checks below verify outcomes — binaries on $PATH, pkg-config modules —
+# on a box that already installed everything; none of them look at the APT_* names, which
+# is the one part of the script that breaks on a clean machine of the wrong release
+# (libqt6svg6-dev did exactly this on 26.04). See gui/docs/pkg-qa-requests-m1.md R2.
+# `apt-cache policy` needs no root and no network; it reads the lists apt already has.
+log "validating apt package names (${#PKGS[@]})"
+missing_pkgs=()
+for pkg in "${PKGS[@]}"; do
+    # `apt-cache policy` exits 0 whether or not the name resolves; a name with no
+    # installable version prints "Candidate: (none)". Grep the line, don't trust $?.
+    cand="$(apt-cache policy "$pkg" 2>/dev/null | sed -n 's/^  Candidate: //p')"
+    if [[ -z "$cand" || "$cand" == "(none)" ]]; then
+        missing_pkgs+=("$pkg")
+    fi
+done
+if (( ${#missing_pkgs[@]} == 0 )); then
+    printf '  \033[32m✓\033[0m %-16s all %d resolve on %s\n' \
+        "apt names" "${#PKGS[@]}" "${VERSION_ID:-this release}"
+elif (( ${#missing_pkgs[@]} == ${#PKGS[@]} )); then
+    warn "no apt candidate for ANY of the ${#PKGS[@]} packages — the apt lists are almost"
+    warn "certainly stale, not the package set. Run 'apt-get update' and re-run --check."
+else
+    for pkg in "${missing_pkgs[@]}"; do
+        printf '  \033[31m✗\033[0m %-16s no installable candidate on %s\n' \
+            "$pkg" "${VERSION_ID:-this release}"
+    done
+    fail=1
+fi
+
 need_cmd git        git --version
 need_cmd cmake      cmake --version
 need_cmd ninja      ninja --version