CI: pin Home tool path across every private ABI build graph

Parent: #495 Related: #630, #646

Evidence

Fresh Linux private-abi-boundary reaches the consumer-provider fixtures after the earlier audits pass, then executes /home/runner/Code/Home/lang/zig-out/bin/home-tool instead of the checked-out pinned runtime at $GITHUB_WORKSPACE/Home/lang/zig-out/bin/home-tool: https://github.com/zig-utils/zig-js/actions/runs/32388315489/job/96488305107

The job exports HOME_TOOL, but an earlier zig build home-tool-bootstrap configures the same no-option build graph before the runtime exists and resolves build.zig through its $HOME/Code/Home/... fallback. Later private-ABI commands omit -Dhome-tool, so cached command identity can retain the stale fallback. The first audit invocation already passes the option explicitly and succeeds.

Required change

• Pass the pinned checked-out Home tool path as an explicit -Dhome-tool option to every zig build invocation in the private-ABI boundary matrix leg.
• Keep one wrapper/definition so new commands cannot silently omit it.
• Preserve all Debug, ReleaseSafe, TSan, Home-profile, Bun-profile, filtered unit, and mixed-profile gates.
• Validate the exact consumer-provider fixtures that failed, then the complete Linux private-ABI leg.

No-workaround rules

No PATH alias, copied fallback binary, skipped provider fixtures, removed build modes, cache deletion as a fix, or dependency on runner $HOME layout. The pinned checkout/runtime remains the only accepted repository-tool implementation.

Acceptance

• Every private-ABI zig build receives the exact pinned path in build-graph identity.
• Debug, ReleaseSafe, and TSan consumer-provider fixtures pass.
• The complete private-ABI boundary leg passes on fresh Linux.
• Test262 flips 0 (CI-only dependency propagation).

Implemented in f17172c8. The private-ABI matrix now defines one zig_with_home_tool wrapper and injects the checked-out runtime through explicit -Dhome-tool build-graph identity for every Debug, ReleaseSafe, TSan, filtered-unit, Home-profile, Bun-profile, and mixed-profile invocation.

Local exact failed-target evidence on pinned Zig dev.1818: Debug, ReleaseSafe, and TSan each pass Home 24/24 plus Bun 24/24 consumer-provider symbols with zero collisions; Home inventory is 538/538 classified and Bun is 484/484 classified. Workflow YAML parses cleanly. Test262 flips 0. Fresh Linux full-leg validation is pending.

Implemented by fix(ci): pin Home tool for private ABI builds (#654).

The workflow now routes every private-ABI Zig build through one wrapper carrying the checked-out Home runtime as explicit -Dhome-tool build-graph identity. Local Debug, ReleaseSafe, and TSan consumer-provider fixtures each passed Home 24/24 plus Bun 24/24 with zero symbol collisions; both inventories remained fully classified.

The fresh cumulative Linux private-ABI boundary job passed the complete Debug, ReleaseSafe, TSan, Home-profile, Bun-profile, filtered-unit, and mixed-profile leg. No PATH alias, fallback binary, cache deletion, skipped fixture, or runner-home dependency remains. CI-only dependency propagation; 0 Test262 flips.