pkg: make bootstrap --check validate apt names, and run it on 26.04

--check verified outcomes — binaries on PATH, pkg-config modules — on a box
that already installed everything. It never looked at the APT_* names, which
is the only part that breaks on a clean machine of the wrong release, as R1
just showed. Add a loop over the assembled PKGS array that fails on any name
with no installable candidate (apt-cache policy; no root, no network).
All-missing is treated as stale lists (warn), not 36 bad names.

The bootstrap-script job runs on a 24.04 runner, where the bad name still
resolves, so name validation there checks the wrong archive. Add
bootstrap-script-2604: a real --with-clang install in an ubuntu:26.04
container — the release the project ships on, and the first time the
fuzz-toolchain half of bootstrap is exercised anywhere (CORE had been running
clang++-21 directly). Also pass --with-clang/--packaging to the 24.04 --check
so the optional and M6 names can't rot unnoticed. BRANCH_PROTECTION.md gains
the 2604 row and the stale "when X merges" rows are corrected to "now".

gui/docs/pkg-qa-requests-m1.md R2 + the --with-clang note.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw

.github/BRANCH_PROTECTION.md

@@ -14,11 +14,12 @@ policy so it can be re-applied or audited.
   |---|---|
   | `clang-format` | now |
   | `testserver` | now |
-  | `bootstrap-script` | now |
+  | `bootstrap-script` | now (validates package names against the 24.04 runner archive) |
-  | `build (gcc)` / `build (clang)` | when the first C++ lane merges |
+  | `bootstrap-script-2604` | now — real `--with-clang` install in a 26.04 container; the release the project ships on |
-  | `sanitizers (dev)` / `sanitizers (tsan)` | when the first C++ lane merges |
+  | `build (gcc)` / `build (clang)` | now — core, daemon and gui have merged |
+  | `sanitizers (dev)` / `sanitizers (tsan)` | now — core, daemon and gui have merged |
   | `conformance` | **now — `tests/conformance/` has landed; this is the M0 exit gate** |
-  | `extension-lint` | when `extension/` lands |
+  | `extension-lint` | now — `extension/` has merged (MV3 manifest + esbuild build) |
 
   `clang-tidy` is intentionally **not** required through M1 (`continue-on-error: true`,
   `.clang-tidy` has `WarningsAsErrors: ''`). Make it required at M2.

.github/workflows/ci.yml

@@ -41,12 +41,38 @@ jobs:
         run: python3 tools/testserver/selftest.py
 
   bootstrap-script:
-    # Keeps tools/bootstrap.sh honest: it must run clean and its --check must pass.
+    # Keeps tools/bootstrap.sh honest on the runner image: it must run clean and its
+    # --check must pass. ubuntu-latest is 24.04; the project ships on 26.04, so this
+    # exercises the 24.04 archive only. bootstrap-script-2604 below is what validates
+    # the package names against the release the project actually targets.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: sudo ./tools/bootstrap.sh --with-clang
-      - run: ./tools/bootstrap.sh --check
+      - run: ./tools/bootstrap.sh --check --with-clang
+      # Cheap: apt-cache only. Validates the M6 packaging names now so they can't rot
+      # unnoticed until M6.
+      - run: ./tools/bootstrap.sh --check --with-clang --packaging
+
+  bootstrap-script-2604:
+    # The project targets 26.04 and GitHub has no 26.04 runner image yet, so the one
+    # automated place bootstrap.sh runs is on the wrong release to catch a name that is
+    # valid on 24.04 and gone on 26.04 — which is exactly how libqt6svg6-dev reached a
+    # contributor's VM (gui/docs/pkg-qa-requests-m1.md R1/R2). Run the real install in a
+    # 26.04 container, with --with-clang: the fuzz toolchain had never been exercised
+    # anywhere (CORE ran clang++-21 directly because it can't sudo).
+    runs-on: ubuntu-latest
+    container: ubuntu:26.04
+    steps:
+      - name: Base tools for checkout
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates git sudo
+      - uses: actions/checkout@v4
+      - name: Full bootstrap on 26.04 (--with-clang)
+        run: ./tools/bootstrap.sh --with-clang
+      - name: Re-verify
+        run: ./tools/bootstrap.sh --check --with-clang
 
   extension-lint:
     runs-on: ubuntu-latest

tools/bootstrap.sh

@@ -146,6 +146,36 @@ need_cmd() {
     fi
 }
 
+# Every apt name this script would install must resolve to an installable candidate on
+# THIS release. The checks below verify outcomes — binaries on $PATH, pkg-config modules —
+# on a box that already installed everything; none of them look at the APT_* names, which
+# is the one part of the script that breaks on a clean machine of the wrong release
+# (libqt6svg6-dev did exactly this on 26.04). See gui/docs/pkg-qa-requests-m1.md R2.
+# `apt-cache policy` needs no root and no network; it reads the lists apt already has.
+log "validating apt package names (${#PKGS[@]})"
+missing_pkgs=()
+for pkg in "${PKGS[@]}"; do
+    # `apt-cache policy` exits 0 whether or not the name resolves; a name with no
+    # installable version prints "Candidate: (none)". Grep the line, don't trust $?.
+    cand="$(apt-cache policy "$pkg" 2>/dev/null | sed -n 's/^  Candidate: //p')"
+    if [[ -z "$cand" || "$cand" == "(none)" ]]; then
+        missing_pkgs+=("$pkg")
+    fi
+done
+if (( ${#missing_pkgs[@]} == 0 )); then
+    printf '  \033[32m✓\033[0m %-16s all %d resolve on %s\n' \
+        "apt names" "${#PKGS[@]}" "${VERSION_ID:-this release}"
+elif (( ${#missing_pkgs[@]} == ${#PKGS[@]} )); then
+    warn "no apt candidate for ANY of the ${#PKGS[@]} packages — the apt lists are almost"
+    warn "certainly stale, not the package set. Run 'apt-get update' and re-run --check."
+else
+    for pkg in "${missing_pkgs[@]}"; do
+        printf '  \033[31m✗\033[0m %-16s no installable candidate on %s\n' \
+            "$pkg" "${VERSION_ID:-this release}"
+    done
+    fail=1
+fi
+
 need_cmd git        git --version
 need_cmd cmake      cmake --version
 need_cmd ninja      ninja --version