ci(helm): install z3 build deps on bare runner

The openshell-cli build pulls in z3-sys, which needs z3's C/C++ headers
plus clang to generate bindings. The bare runner used by helm-e2e
doesn't ship them, so install them via apt before invoking
mise run e2e:helm. The CI container image other Rust e2e jobs use has
these deps preinstalled, but we can't switch helm-e2e to that container
because GHA's container handler injects its own --network bridge,
conflicting with the --network host that kind's host-loopback API
server needs to be reachable from inside the container.

Signed-off-by: Taylor Mutch <taylormutch@gmail.com>

Author: TaylorMutch

.github/workflows/branch-helm-e2e.yml

@@ -77,6 +77,16 @@ jobs:
       - name: Install tools
         run: mise install --locked
 
+      # The openshell-policy crate transitively pulls in z3-sys, whose
+      # build script needs the z3 C/C++ headers and clang/bindgen to
+      # compile. The bare runner doesn't ship them; the CI container
+      # image used by other Rust e2e jobs does, but we can't run helm-e2e
+      # there (the runner's container handler injects its own --network
+      # bridge, which conflicts with the --network host we need so kind's
+      # API server is reachable from the test process).
+      - name: Install z3 build deps
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libz3-dev clang
+
       - name: Log in to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin