Add a manual CI build for the patched planegcs glue

[MakerViking]

Adds .github/workflows/planegcs-glue.yml. Manual trigger only (workflow_dispatch); it produces an artifact plus provenance and changes nothing in the app.

Why

The 2D constraint solver needs 'unsafe-eval' only because planegcs is an emscripten/embind module: embind's new_ helper hands source text to the Function constructor. Closure specialises it to var a=Function; ... a.apply(c,b), which is why grepping for new Function( finds nothing and is not evidence of absence — that false negative is what kept this misdiagnosed while four reporters were told to update a runtime that was never the problem.

Upstream PR Salusoft89/planegcs#12 proposes the same one-line flag but is still open, and its branch is based on 1.2.0 — taking it would silently upgrade the solver alongside the CSP fix. This applies -s DYNAMIC_EXECUTION=0 to the exact commit that produced the 1.1.7 artifact in package-lock.json (951ba1a5, proven via the npm packument's gitHead).

The control build is the point

Building with the flag proves nothing on its own. The job first builds the source unmodified and requires byte-identity with the published npm artifact — that is what establishes this toolchain is the maintainer's, and therefore that the flag is the only variable. Two further gates follow: the wasm must be unchanged (or it is not the glue-only change it claims to be), and the patched glue must actually shed Function references (or the flag did not take effect). If the control does not reproduce, no patched artifact is emitted.

Building in CI rather than on a workstation is deliberate. Vendoring a binary into a public AGPL repo needs provenance a local build cannot give: this leaves public logs, the pinned commit, the toolchain image and checksums beside the artifact. It also keeps third-party native install scripts — tree-sitter needs them to generate bindings.cpp, which upstream stopped committing — in a disposable runner.

Verified before pushing

• both published checksums in the workflow match the installed artifact
• the sed applies exactly once to the pinned CMakeLists.txt
• bindings.cpp is generated, not committed (upstream dropped it in 0cc67f3), so build:bindings must run first — a local build failed at cmake without it

Not in this PR

Vendoring the artifact and tightening the CSP are separate, deliberate steps. tauri dev serves without the CSP, so tightening it without the patched glue would ship a dead solver that looks perfect in development.

[MakerViking]

Superseded, not abandoned: 54f40ce (now on main) carries this workflow with the corrections that came out of actually running it.

Two sessions wrote this file independently — 21b49d8 on the todo-sweep branch and 2027cbc here — and only this lineage learned what happened on a real run. Those lessons are what landed:

• the wasm hashes are recorded with a warning instead of gated, because three runs at the same pinned commit in the same container disagreed (once control matched the published binary and patched did not, once the exact opposite, once neither). The JS glue reproduced byte for byte every time, so the non-determinism is in the wasm compile and a byte comparison across it proves nothing in either direction;
• both builds run -j 1 with that determinism note;
• DEFAULT_REF so a workflow_dispatch with no input works;
• artifacts upload on always(), because a failed gate is exactly when they are worth having;
• the temporary push trigger is gone.

This branch is also based on an older main and merging it would have reverted 14 lines of build.yml. Closing rather than merging; nothing here is lost.