build(wasm): standardize asyncify wasm-opt tail to -O1 everywhere

The Binaryen wasm-opt shrink after Asyncify was the only -O2 in the
pipeline: -O2 by default (local + tag release) but -O1 in main CI. The
C++/wx/deps compile is already -O1 everywhere (DEBUG_BUILD defaults to 1;
nothing passes --release in CI/release). Pin the tail to -O1 too:

- apply-asyncify.sh: BINARYEN_OPT_LEVEL default -O2 -> -O1
- release.yml: opt_level -O2 -> -O1 (demo now ships -O1)
- ci-ubicloud.yml / wasm-build.yml / docker/build.sh: refresh stale -O2 comments

Because both callers now build at -O1, the FINAL cache key converges, so a
tag release FINAL-cache-hits main's build and skips the asyncify-tail
rebuild entirely (previously the ~1-2h -O2 wasm-opt was rerun per release).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci-ubicloud.yml

@@ -2,10 +2,10 @@ name: CI full build + e2e (Ubicloud)
 
 # Main/PR gate: build all 6 KiCad WASM tools + run the wxWidgets + KiCad e2e
 # suites on a Ubicloud runner. The actual recipe lives in the reusable
-# wasm-build.yml (the SINGLE build definition) — this is just the main/PR caller,
-# pinned to -O1 for fast feedback. The tag release (release.yml) calls the same
-# recipe at -O2 (the shipped demo opt level) and then publishes, so the build can
-# never diverge from what ships.
+# wasm-build.yml (the SINGLE build definition) — this is just the main/PR caller.
+# The asyncify wasm-opt tail is -O1 everywhere (main, release, local); the tag
+# release (release.yml) calls the same recipe at the same -O1 and then publishes,
+# so the build can never diverge from what ships.
 #
 # Routine edits under scripts/ do NOT bust the WASM output cache — only the subset
 # in scripts/deploy/wasm-cache-hash.mjs does. For inputs the sc-hash can't see
@@ -36,8 +36,8 @@ jobs:
   build:
     uses: ./.github/workflows/wasm-build.yml
     with:
-      # -O1: faster asyncify shrink, sufficient for the test gate (the demo ships
-      # -O2 via release.yml). 3D viewer ON so 3d-viewer.spec.ts has a viewer.
+      # -O1 asyncify shrink — the level we ship (release.yml uses the same -O1).
+      # 3D viewer ON so 3d-viewer.spec.ts has a viewer.
       opt_level: "-O1"
       build_3d_viewer: "ON"
       run_tests: true

.github/workflows/release.yml

@@ -1,10 +1,11 @@
 name: release
 
 # Release pipeline on a vX.Y.Z tag, in order:
-#   1) build  — the SAME wasm-build.yml recipe as CI, but at -O2 (the shipped demo
-#               opt level) + run the e2e gate; reuses main's opt-independent base
-#               cache so only the asyncify/-O2 tail rebuilds. Uploads output/.
-#   2) publish-wasm — push the -O2 build to the CDN (content-addressed, idempotent)
+#   1) build  — the SAME wasm-build.yml recipe as CI, at the SAME -O1 asyncify tail
+#               + run the e2e gate. Because the opt level now matches main, this
+#               FINAL-cache-hits main's build and skips the asyncify tail rebuild.
+#               Uploads output/.
+#   2) publish-wasm — push the build to the CDN (content-addressed, idempotent)
 #               and write manifest-<tag>.json. The registry now reflects THIS tag.
 #   3) deploy-demo  — build the standalone pinned to that manifest + deploy to
 #               demo.pcbjam.com. So the demo can never point at stale wasm.
@@ -49,17 +50,18 @@ jobs:
       - id: tag
         run: echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
 
-  # 1) Build at -O2 (shipped) + e2e gate, reusing main's base cache. Uploads the
-  #    publishable output/ as the 'wasm-output' artifact for the publish job.
+  # 1) Build (-O1, identical to main) + e2e gate. Reuses main's FINAL cache (same
+  #    opt level) so the asyncify tail isn't rebuilt. Uploads the publishable
+  #    output/ as the 'wasm-output' artifact for the publish job.
   build:
     uses: ./.github/workflows/wasm-build.yml
     with:
-      opt_level: "-O2"
+      opt_level: "-O1"
       build_3d_viewer: "ON"
       run_tests: true
       upload_output: true
 
-  # 2) Publish the -O2 build to the CDN (content-addressed; unchanged tools reuse)
+  # 2) Publish the build to the CDN (content-addressed; unchanged tools reuse)
   #    and write manifest-<tag>.json. Cheap runner — just downloads + uploads.
   publish-wasm:
     needs: [meta, build]

.github/workflows/wasm-build.yml

@@ -1,27 +1,29 @@
 name: wasm-build (reusable)
 
-# THE single KiCad WASM build+test recipe, called by ci-ubicloud.yml (main/PR,
-# -O1 for fast feedback) and release.yml (tag, -O2 for the shipped demo). There
-# is no other build definition — publishing/deploy consume this job's output, so
-# the build can never diverge from what ships (the bug that shipped a -O1 / 3D-off
-# demo while CI built -O1 / 3D-on).
+# THE single KiCad WASM build+test recipe, called by ci-ubicloud.yml (main/PR) and
+# release.yml (tag). Both build the SAME way — the asyncify `wasm-opt` tail is -O1
+# everywhere — so the build can never diverge from what ships (the bug that shipped
+# a -O1 / 3D-off demo while CI built -O1 / 3D-on). The opt_level input remains as an
+# escape hatch for a one-off -O2 build, but is -O1 for both real callers, so a tag
+# release FINAL-cache-hits main's build and skips the asyncify tail entirely.
 #
 # Two-tier output cache around docker/build.sh's --compile-only / --postprocess-only
-# split. -O1 and -O2 differ ONLY in the final `wasm-opt -O` shrink; everything
-# before (docker compile → base wasm → asyncify instrument) is identical. So:
-#   - BASE cache  (opt-INDEPENDENT key): the --compile-only output (base wasm +
-#     sysroot headers). Warmed by main's -O1 CI; an -O2 release restores it and
-#     skips the expensive compile, running only the asyncify/-O2 tail.
-#   - FINAL cache (opt-SPECIFIC key): the post-processed output; fast-path for
-#     re-running the same opt+SHA (e.g. a re-deploy).
-# Both keys now include the 3D-viewer flag, so a 3D-on and 3D-off build can never
+# split. The expensive container compile (→ base wasm) is opt- and binaryen-
+# independent; only the host `asyncify + wasm-opt -O` tail depends on the binaryen
+# fork + opt level. So:
+#   - BASE cache  (compile-input key): the --compile-only output (base wasm +
+#     sysroot headers). Reused whenever only the binaryen fork / asyncify config
+#     changed — the compile is skipped and just the tail reruns.
+#   - FINAL cache (base + binaryen SHA + opt level): the post-processed output;
+#     fast-path for re-running the same SHA (a tag release reusing main, a re-deploy).
+# Both keys include the 3D-viewer flag, so a 3D-on and 3D-off build can never
 # poison each other's cache.
 
 on:
   workflow_call:
     inputs:
       opt_level:
-        description: "Binaryen wasm-opt shrink level for the asyncify tail (-O1 fast / -O2 shipped)"
+        description: "Binaryen wasm-opt shrink level for the asyncify tail (-O1 everywhere; escape hatch for a one-off -O2)"
         type: string
         default: "-O1"
       build_3d_viewer: