fix(wasm-eh): build wasm-emscripten-finalize from the Binaryen submodule (unbreak CI)

The native-EH migration pointed apply-finalize.sh at emsdk's bundled
wasm-emscripten-finalize (${EMSDK:-tools/emsdk}/upstream/bin), which exists on a
dev machine (tools/emsdk persists from a prior build) but never on the ephemeral
CI host — emsdk lives only inside the Docker image, and nothing on the host
post-process path provisions it. So the host post-process died at finalize for
every app once the binaryen-SHA cache re-key forced it to actually run. (Not the
missing-ninja theory — ninja was installed; the run never reached the wasm-opt
build, which is downstream of finalize.)

Finish the "Binaryen submodule everywhere" migration: build-wasm-opt.sh now also
builds wasm-emscripten-finalize, and apply-finalize.sh takes it from that build
(next to wasm-opt). The host post-process is now emsdk-free (dyncall=node,
finalize+asyncify=submodule v130) and finalize/wasm-opt share one Binaryen
version (previously finalize was emsdk's v121, wasm-opt the submodule's v130).
get-wasm-opt.sh stays for bench only; dropped it from the wasm cache key and
added build-wasm-opt.sh.

Also surface the from-source Binaryen build as a "Build Binaryen" stage in
build-monitor.sh (it had no marker), emitted at the pipelined pre-warm sites.

Validated: a clean from-scratch `docker/build.sh calculator --build-deps` (deps +
compile + finalize via the submodule binary + asyncify + -O2) succeeded
end-to-end; finalize resolved to build-wasm/tools/binaryen-hoist-build/bin.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/build.sh

@@ -357,6 +357,7 @@ elif [[ "$PHASE" == "postprocess" ]]; then
     # wasm (no container). Parallelize across apps when pipelining.
     if [[ "${KICAD_PIPELINE:-0}" == "1" ]] && [ "$TOTAL_APPS" -gt 1 ]; then
         mkdir -p "$PIPELINE_LOG_DIR"
+        kw_stage binaryen
         ./scripts/binaryen-hoist-pass/build-wasm-opt.sh >/dev/null  # pre-warm Binaryen (submodule) once
         _install_pipeline_trap
         for app in "${APPS[@]}"; do
@@ -374,6 +375,7 @@ elif [[ "${KICAD_PIPELINE:-0}" == "1" ]] && [ "$TOTAL_APPS" -gt 1 ]; then
     mkdir -p "$PIPELINE_LOG_DIR"
     # Pre-build the Binaryen submodule once — two concurrent postprocesses racing
     # the first from-source build would collide.
+    kw_stage binaryen
     ./scripts/binaryen-hoist-pass/build-wasm-opt.sh >/dev/null
     _install_pipeline_trap
     idx=1

scripts/binaryen-hoist-pass/build-wasm-opt.sh

@@ -1,10 +1,14 @@
 #!/bin/bash
-# Build a wasm-opt that includes the catch-arm-hoisting pass (--hoist-cpp-catches).
+# Build the host post-process Binaryen tools from our submodule: wasm-opt (with the
+# catch-arm-hoisting pass, --hoist-cpp-catches) AND wasm-emscripten-finalize.
 #
 # Source of truth is the tracked Binaryen submodule (binaryen/, branch wasm-port =
 # upstream version_130 + src/passes/HoistCppCatches.cpp). This configures an out-of-source
 # build into the gitignored build-wasm/ tree and prints the wasm-opt path on stdout
-# (build progress to stderr). See docs/features/wasm-exceptions/06-spike-plan.md (Phase 1.5).
+# (build progress to stderr); wasm-emscripten-finalize lands next to it in the same bin/
+# (apply-finalize.sh derives it from the wasm-opt dir). Building both from one submodule
+# keeps finalize and asyncify on a single Binaryen version and removes the host emsdk
+# dependency from the post-process. See docs/features/wasm-exceptions/06-spike-plan.md (Phase 1.5).
 set -eo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -27,6 +31,6 @@ if [ ! -f "${BUILD}/build.ninja" ]; then
         -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON -DBUILD_TESTS=OFF >&2
 fi
 
-ninja -C "${BUILD}" wasm-opt >&2
+ninja -C "${BUILD}" wasm-opt wasm-emscripten-finalize >&2
 
 echo "${BUILD}/bin/wasm-opt"

scripts/build-monitor.sh

@@ -98,6 +98,7 @@ BEGIN {
     ord[++ROWN] = "kicad-compile";   lab["kicad-compile"]   = "KiCad compile"
     ord[++ROWN] = "kicad-bitmaps";   lab["kicad-bitmaps"]   = "Bitmap resources"
     ord[++ROWN] = "copy-output";     lab["copy-output"]     = "Copy output"
+    ord[++ROWN] = "binaryen";        lab["binaryen"]        = "Build Binaryen"
     ord[++ROWN] = "dyncall-shims";   lab["dyncall-shims"]   = "dynCall shims"
     ord[++ROWN] = "finalize";        lab["finalize"]        = "Finalize WASM"
     ord[++ROWN] = "asyncify";        lab["asyncify"]        = "Asyncify"
@@ -172,6 +173,8 @@ function render_markers(   state, totalEl, pk, curIdx, i, k, st, det, subdet, en
         printf "H|-|0|0|%d|%s\n", totalEl, state
         if (curRawKey == "container-sync") {
             printf "R|active|Sync source to container|%s\n", fmt(termTs - rowStartTs["container-sync"])
+        } else if (curRawKey == "binaryen") {
+            printf "R|active|Build Binaryen|%s\n", fmt(termTs - rowStartTs["binaryen"])
         } else {
             printf "N|waiting for build to start...\n"
         }

scripts/common/apply-finalize.sh

@@ -8,15 +8,14 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
 
-# wasm-emscripten-finalize ships with emscripten (it was removed from Binaryen ~v116), so use the
-# emsdk's own — the one emscripten would run in-link — directly. No binaryen download. A host-mode
-# kicad/test build stubs the emsdk finalize and keeps the real binary at .real; prefer it (the stub
-# exits 0 having done nothing).
-EMSDK_DIR="${EMSDK:-${PROJECT_ROOT}/tools/emsdk}"
-FINALIZE="${EMSDK_DIR}/upstream/bin/wasm-emscripten-finalize"
-if [ -x "${FINALIZE}.real" ]; then
-    FINALIZE="${FINALIZE}.real"
-fi
+# wasm-emscripten-finalize comes from our Binaryen submodule (version_130 + --hoist-cpp-catches),
+# built alongside wasm-opt by build-wasm-opt.sh. Pinning finalize and the asyncify wasm-opt to ONE
+# Binaryen version removes the host's emsdk dependency from the post-process entirely (it is now
+# dyncall=node + finalize/asyncify=submodule), which is what was breaking on the ephemeral CI host.
+# HOIST_WASMOPT, when the build driver pre-warms the submodule build, points at the already-built
+# wasm-opt so we don't re-invoke the build per app; finalize sits next to it in the same bin/.
+WASM_OPT="${HOIST_WASMOPT:-$("${SCRIPT_DIR}/../binaryen-hoist-pass/build-wasm-opt.sh")}"
+FINALIZE="$(dirname "${WASM_OPT}")/wasm-emscripten-finalize"
 
 INPUT_WASM="${1:-output/pcbnew.wasm}"
 OUTPUT_WASM="${2:-${INPUT_WASM}}"

scripts/deploy/wasm-cache-hash.mjs

@@ -51,7 +51,10 @@ const INPUTS = [
   { file: "scripts/common/apply-asyncify.sh" },
   { file: "scripts/common/apply-finalize.sh" },
   { file: "scripts/common/inject-dyncall-shims.sh" },
-  { file: "scripts/common/get-wasm-opt.sh" },
+  // The submodule build that provides BOTH host wasm-opt and wasm-emscripten-finalize.
+  // (get-wasm-opt.sh is no longer on the build path — bench-only — so it no longer
+  // belongs in the cache key.)
+  { file: "scripts/binaryen-hoist-pass/build-wasm-opt.sh" },
 
   // Per-tool compile recipes (compile flags / emcc link options).
   { dir: "scripts/kicad", match: /^build-.*\.sh$/ },