feat(qemu): provision Linux runtime libraries instead of requiring apt

.github/workflows/qemu-linux-runtime.yml

@@ -0,0 +1,76 @@
+name: QEMU Linux Runtime
+
+# Proves fbuild can start Espressif QEMU on a stock Linux runner without any
+# host library installation. `ubuntu-latest` (24.04) ships none of libslirp,
+# libSDL2 or libpixman, which the Espressif QEMU binaries link against — so
+# this job is red unless fbuild provisions them itself.
+#
+# There is deliberately NO apt-get step here. Adding one would make the job
+# pass for the wrong reason.
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: [main]
+    paths:
+      - 'crates/fbuild-toolchain/**'
+      - 'crates/fbuild-daemon/src/handlers/emulator/**'
+      - 'ci/build_qemu_linux_runtime.py'
+      - '.github/workflows/qemu-linux-runtime.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'crates/fbuild-toolchain/**'
+      - 'crates/fbuild-daemon/src/handlers/emulator/**'
+      - 'ci/build_qemu_linux_runtime.py'
+      - '.github/workflows/qemu-linux-runtime.yml'
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  qemu_runtime:
+    name: QEMU starts with no host libraries (ubuntu-latest)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Confirm the runner really is missing the libraries
+        # Documents the premise of the test. Informational: a future runner
+        # image that ships them makes the test exercise the host path, which
+        # is still a valid pass.
+        run: |
+          for lib in libslirp.so.0 libSDL2-2.0.so.0 libpixman-1.so.0; do
+            if ldconfig -p | grep -q "$lib"; then
+              echo "present: $lib"
+            else
+              echo "absent:  $lib  <- fbuild must provision this"
+            fi
+          done
+
+      - uses: astral-sh/setup-uv@v3
+
+      - name: Setup soldr
+        uses: zackees/setup-soldr@v0
+        with:
+          version: 0.8.23
+          cache: true
+          build-cache: true
+          target-cache: true
+          prebuild-deps: none
+          linker: platform-default
+
+      - name: QEMU runtime provisioning test
+        run: |
+          soldr cargo test -p fbuild-toolchain --test qemu_linux_runtime -- \
+            --ignored --nocapture

.github/workflows/qemu-runtime-bundle.yml

@@ -0,0 +1,50 @@
+name: Build QEMU Linux Runtime Bundle
+
+# Manually-dispatched builder for the runtime-library bundles fbuild downloads
+# when a Linux host cannot start Espressif QEMU on its own.
+#
+# The bundle is always built inside an ubuntu:20.04 container, so the libraries
+# it carries need at most GLIBC_2.30 — the same floor the Espressif QEMU
+# binaries themselves have. The runner only supplies the CPU architecture:
+# aarch64 needs a native arm64 runner because dpkg's maintainer scripts fail
+# under emulated arm64.
+#
+# Upload the resulting artifacts to the `qemu-linux-runtime-v1` release and
+# paste the printed SHA-256 into
+# crates/fbuild-toolchain/src/toolchain/esp_qemu_runtime.rs.
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  bundle:
+    name: ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-latest
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v3
+
+      - name: Build bundle
+        run: |
+          uv run --no-project python ci/build_qemu_linux_runtime.py \
+            --arch ${{ matrix.arch }} --out dist/qemu-runtime
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: qemu-esp-linux-runtime-${{ matrix.arch }}
+          path: dist/qemu-runtime/*
+          if-no-files-found: error

ci/README.md

@@ -5,6 +5,7 @@ Python scripts for CI, packaging, and development tooling. All invoked via `uv r
 ## Contents
 
 - **`build_dist.py`** -- Triggers GitHub Actions native builds, downloads artifacts, and assembles `dist/` for PyPI packaging
+- **`build_qemu_linux_runtime.py`** -- Builds the Linux runtime-library bundle Espressif QEMU needs (`ldd` closure minus glibc, built on ubuntu:22.04). Published to the `qemu-linux-runtime-v1` release and downloaded on demand by `fbuild-toolchain`'s `esp_qemu_runtime` module; run in CI by `qemu-runtime-bundle.yml`
 - **`check_workspace_crates.py`** -- Monocrate guard: fails if the root `Cargo.toml` `[workspace] members` list gains a crate outside the approved allowlist (run by `crate-gate.yml`)
 - **`check_rust_toolchain_pins.py`** -- Prevents fbuild-owned Rust 1.95.0 MSRV, toolchain, workflow, and bootstrap declarations from drifting
 - **`enforce_platform_boundary.py`** -- Independent whole-tree and manifest checker for the exact host-platform occurrence ledger