feat(box): curated 3-image box boot + #715 build-debt fixes

.github/workflows/build-c.yml

@@ -15,12 +15,23 @@
 # Triggers:
 # - release: When a GitHub release is published
 # - workflow_dispatch: Manual trigger for testing
+# - workflow_call:     Reusable from .github/workflows/e2e-cloud.yml.
+#                      Pass target_filter='linux-x64-gnu' to skip the
+#                      macOS/arm64 matrix entries (only the Tokyo
+#                      runner target is needed).
 name: Build C SDK
 
 on:
   release:
     types: [ published ]
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      target_filter:
+        description: 'Optional. Build only the given target (e.g. "linux-x64-gnu"). Empty = build all matrix platforms.'
+        type: string
+        default: ''
+        required: false
 
 env:
   CARGO_TERM_COLOR: always
@@ -30,30 +41,57 @@
   config:
     uses: ./.github/workflows/config.yml
 
+  # Compute the matrix the `build` job iterates over. When called via
+  # workflow_call with target_filter set, narrow to that single entry.
+  # `matrix` context is not available in job-level if:, so we filter
+  # the JSON here and have `build` consume `setup_matrix.outputs.platforms`.
+  setup_matrix:
+    name: Setup matrix
+    needs: config
+    runs-on: ubuntu-latest
+    outputs:
+      platforms: ${{ steps.filter.outputs.platforms }}
+    steps:
+      - id: filter
+        env:
+          ALL_PLATFORMS: ${{ needs.config.outputs.platforms }}
+          TARGET_FILTER: ${{ inputs.target_filter }}
+        run: |
+          if [ -n "${TARGET_FILTER:-}" ]; then
+            FILTERED=$(printf '%s' "$ALL_PLATFORMS" | jq -c --arg t "$TARGET_FILTER" '[.[] | select(.target == $t)]')
+            COUNT=$(printf '%s' "$FILTERED" | jq 'length')
+            [ "$COUNT" -ge 1 ] || { echo "::error::No matrix entry matches target_filter=$TARGET_FILTER"; exit 1; }
+            echo "Filtered to $COUNT entry(ies): $FILTERED"
+          else
+            FILTERED="$ALL_PLATFORMS"
+            echo "No filter — full matrix"
+          fi
+          echo "platforms=$FILTERED" >> "$GITHUB_OUTPUT"
+
   # ============================================================================
   # BUILD
   # ============================================================================
   # Builds libboxlite for each platform (static + shared) and packages with
   # C headers.
   #
   # Platform-specific considerations:
   # - Linux: Uses manylinux_2_28 container for glibc compatibility
   #   - Guest binary built on host first (Ubuntu has musl-tools, manylinux doesn't)
   #   - Runtime/libkrun built in container (needs glibc 2.28)
   # - macOS: Builds directly on runner (ARM64 only)
   #
   # After building, fix-go-symbols.sh localizes Go runtime symbols from
   # embedded libgvproxy in the static library, preventing conflicts when
   # linked into a Go binary.
   # ============================================================================
   build:
     name: Build (${{ matrix.target }})
-    needs: config
+    needs: [config, setup_matrix]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJson(needs.config.outputs.platforms) }}
+        include: ${{ fromJson(needs.setup_matrix.outputs.platforms) }}
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-runner-binary.yml

@@ -11,13 +11,30 @@
 # Triggers:
 # - workflow_run: After "Build C SDK" completes (ensures libboxlite.a exists)
 # - workflow_dispatch: Manual trigger for testing
+# - workflow_call: Reusable callers can set libboxlite_source=build to use a
+#                  C SDK artifact built from the same checkout.
 name: Build Runner Binary
 
 on:
   workflow_run:
     workflows: ["Build C SDK"]
     types: [completed]
   workflow_dispatch:
+    inputs:
+      libboxlite_source:
+        description: 'libboxlite.a source for manual runs'
+        type: choice
+        default: source
+        options:
+          - source
+          - release
+  workflow_call:
+    inputs:
+      libboxlite_source:
+        description: 'How to obtain libboxlite.a: release, build, or source'
+        type: string
+        default: release
+        required: false
 
 permissions:
   contents: read
@@ -56,7 +73,14 @@ jobs:
           VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
+      - name: Set up Rust
+        if: inputs.libboxlite_source == 'source'
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ needs.config.outputs.rust-toolchain }}
+
       - name: Download prebuilt libboxlite.a
+        if: inputs.libboxlite_source == '' || inputs.libboxlite_source == 'release'
         env:
           VERSION: ${{ steps.version.outputs.version }}
           GH_REPO: ${{ github.repository }}
@@ -67,6 +91,34 @@ jobs:
           curl -fsSL "${URL}" | tar xz -C /tmp/
           cp "/tmp/boxlite-c-v${VERSION}-linux-x64-gnu/lib/libboxlite.a" sdks/go/libboxlite.a
 
+      - name: Download libboxlite.a from sibling Build C SDK job
+        if: inputs.libboxlite_source == 'build'
+        uses: actions/download-artifact@v4
+        with:
+          name: c-sdk-linux-x64-gnu
+          path: /tmp/c-sdk/
+
+      - name: Stage libboxlite.a from sibling artifact
+        if: inputs.libboxlite_source == 'build'
+        run: |
+          set -euo pipefail
+          ARCHIVE=$(ls /tmp/c-sdk/boxlite-c-v*-linux-x64-gnu.tar.gz | head -1)
+          [ -n "$ARCHIVE" ] || { echo "::error::No c-sdk archive in artifact"; exit 1; }
+          tar xzf "$ARCHIVE" -C /tmp/c-sdk/
+          A=$(find /tmp/c-sdk -name libboxlite.a | head -1)
+          [ -n "$A" ] || { echo "::error::libboxlite.a not found in archive"; exit 1; }
+          mkdir -p sdks/go
+          cp "$A" sdks/go/libboxlite.a
+          ls -lh sdks/go/libboxlite.a
+
+      - name: Build libboxlite.a from current source
+        if: inputs.libboxlite_source == 'source'
+        run: |
+          make setup:build runtime dist:go
+          mkdir -p sdks/go
+          cp target/release/libboxlite.a sdks/go/libboxlite.a
+          ls -lh sdks/go/libboxlite.a
+
       - name: Rewrite go.work for minimal modules
         run: |
           printf 'go 1.25.4\n\nuse (\n\t./runner\n\t./daemon\n\t./common-go\n\t./api-client-go\n\t./libs/computer-use\n\t../sdks/go\n)\n' > apps/go.work