ci: build the native binary in CI from vendored Chez

ober

69d8bdf0f1a6121348dffeb34ceabc8c8b9de991

diff --git a/.build.yml b/.build.yml
index 37400ec..9e1978d 100644
--- a/.build.yml
+++ b/.build.yml
@@ -7,30 +7,54 @@ packages:
   - qt6-webengine-dev
   - libgl1-mesa-dev
   - file
+  # Toolchain for building Chez (vendored in the jerboa repo) + linking the
+  # self-contained native binary (jb-main links -lkernel -llz4 -lz -luuid -lncurses).
+  - build-essential
+  - libncurses-dev
+  - uuid-dev
+  - liblz4-dev
+  - zlib1g-dev
 sources:
   - https://git.sr.ht/~lisp/jerboa-browser
+  # Chez Scheme is vendored in the jerboa repo (vendor/ChezScheme); cloned so CI
+  # can build it and the Jerboa stdlib closure into the native binary.
+  - https://git.sr.ht/~lisp/jerboa
 artifacts:
   # Saved + downloadable from the build job page. Path is relative to ~ (home);
   # the repo is cloned to ~/jerboa-browser and build-tarball.sh writes here.
   - jerboa-browser/qt-webengine/build/jerboa-browser-0.0.1-linux-x86_64.tar.gz
 tasks:
+  - chez: |
+      # Build Chez from the source vendored in the jerboa repo, so the binary
+      # embeds the in-repo Chez (no external/stock Chez). Install to /usr/local
+      # so `scheme` is on PATH for build-tarball.sh.
+      cd jerboa/vendor/ChezScheme
+      ./configure --threads --enable-harden --disable-x11 --installprefix=/usr/local
+      make -j$(nproc)
+      sudo make install
+      scheme --version
   - build: |
       cd jerboa-browser
       qmake6 --version || true
-      bash packaging/linux/build-tarball.sh
+      # With Chez + the Jerboa lib present, build-tarball.sh now ALSO compiles
+      # the self-contained native jerboa-browser binary and stages it in bin/.
+      JERBOA_HOME="$HOME/jerboa" SCHEME="$(command -v scheme)" \
+        bash packaging/linux/build-tarball.sh
   - verify: |
       cd jerboa-browser
-      # This CI image has no Chez/Jerboa, so build-tarball.sh ships sources only
-      # (no native binary). Verify the FFI .so + the tarball; the self-contained
-      # jerboa-browser binary is built/checked on a host with the toolchain.
       so=qt-webengine/build/libjerboa_browser.so
       tb=qt-webengine/build/jerboa-browser-0.0.1-linux-x86_64.tar.gz
       test -f "$so" || { echo "MISSING $so"; exit 1; }
       test -f "$tb" || { echo "MISSING $tb"; exit 1; }
-      file "$so" || true
       echo "--- Qt links ---"
       ldd "$so" | grep -i 'qt6\|webengine' || true
       echo "--- tarball ---"
       ls -lh "$tb"
       tar tzf "$tb" | grep -E 'lib/libjerboa_browser.so$' \
         || { echo "lib missing from tarball"; exit 1; }
+      # The native binary MUST be present now (this is the whole point).
+      tar tzf "$tb" | grep -E 'bin/jerboa-browser$' \
+        || { echo "native binary missing from tarball"; exit 1; }
+      echo "--- native binary ---"
+      tar xzf "$tb" -O jerboa-browser-0.0.1-linux-x86_64/bin/jerboa-browser \
+        > /tmp/jb && file /tmp/jb