fix(ci): binaryen tools cache also needs lib/ — bin-only restore broke every post-process

The binopt cache from b4cb10b saved only binaryen-hoist-build/bin, but the
tools dynamically link lib/libbinaryen.so, so the first cache HIT (run
28585074335) failed all 7 tools' finalize with a loader error. Cache bin/ +
lib/, bump the key to binopt-v2 (Ubicloud never re-saves an exact-key hit, so
the poisoned v1 entry can't be repaired in place), and make the
BINARYEN_TRUST_PREBUILT guard exec both tools with --version instead of -x
existence checks so an incomplete restore falls through to a source build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTxTrY9on6A8gLvogFbGiy

.github/workflows/wasm-build.yml

@@ -119,17 +119,21 @@ jobs:
           echo "WASM output-cache restore skip=$SKIP"
 
       # Binaryen post-process tools (submodule fork): otherwise built from source on
-      # every fresh VM (~46s on 30 cores, measured run 28577824366). Cache just bin/
+      # every fresh VM (~46s on 30 cores, measured run 28577824366). Cache bin/ AND
-      # keyed on the exact submodule SHA; on a hit BINARYEN_TRUST_PREBUILT tells
+      # lib/ (the tools dynamically link lib/libbinaryen.so — bin/ alone is a loader
-      # build-wasm-opt.sh to skip cmake+ninja and trust the restored binaries.
+      # error at first exec, run 28585074335), keyed on the exact submodule SHA; on a
+      # hit BINARYEN_TRUST_PREBUILT tells build-wasm-opt.sh to skip cmake+ninja and
+      # trust the restored binaries. v2: v1 entries hold a poisoned bin-only layout.
       # Needed by BOTH the host post-process (final-miss path) and the test-app
       # build, hence not gated on run_tests.
       - name: Cache Binaryen post-process tools
         id: binopt-cache
         uses: actions/cache@v4
         with:
-          path: build-wasm/tools/binaryen-hoist-build/bin
+          path: |
-          key: binopt-${{ runner.os }}-${{ steps.keys.outputs.bin }}
+            build-wasm/tools/binaryen-hoist-build/bin
+            build-wasm/tools/binaryen-hoist-build/lib
+          key: binopt-v2-${{ runner.os }}-${{ steps.keys.outputs.bin }}
 
       - name: Trust prebuilt Binaryen tools (cache hit)
         if: steps.binopt-cache.outputs.cache-hit == 'true'

scripts/binaryen-hoist-pass/build-wasm-opt.sh

@@ -22,12 +22,16 @@ if [ ! -f "${SRC}/src/passes/HoistCppCatches.cpp" ]; then
     exit 1
 fi
 
-# CI fast-path: the workflow cache-restores bin/ keyed on the exact submodule SHA and
+# CI fast-path: the workflow cache-restores bin/ + lib/ keyed on the exact submodule
-# sets this var on a hit, so the restored binaries are authoritative — skip cmake+ninja.
+# SHA and sets this var on a hit, so the restored binaries are authoritative — skip
-# Never set it locally when iterating on the pass: uncommitted source edits would be
+# cmake+ninja. Trust only if both tools actually RUN: the binaries dynamically link
-# silently ignored (the SHA key can't see them).
+# lib/libbinaryen.so, so an existence check alone passes on an incomplete restore
+# (bin/ without lib/ shipped a red main, run 28585074335) while --version proves the
+# loader resolves everything. Never set the var locally when iterating on the pass:
+# uncommitted source edits would be silently ignored (the SHA key can't see them).
 if [ "${BINARYEN_TRUST_PREBUILT:-0}" = "1" ] \
-   && [ -x "${BUILD}/bin/wasm-opt" ] && [ -x "${BUILD}/bin/wasm-emscripten-finalize" ]; then
+   && "${BUILD}/bin/wasm-opt" --version >/dev/null 2>&1 \
+   && "${BUILD}/bin/wasm-emscripten-finalize" --version >/dev/null 2>&1; then
     echo "Using prebuilt Binaryen tools (BINARYEN_TRUST_PREBUILT=1): ${BUILD}/bin" >&2
     echo "${BUILD}/bin/wasm-opt"
     exit 0