O1b-2: переиспользовать runtime-арены Session

.github/workflows/ci.yml

@@ -485,7 +485,8 @@ jobs:
         #     runner.temp first: shared self-hosted images can retain stale lists
         #     whose package URLs already return 404. `apt-get download` fetches
         #     .deb and `dpkg --extract` unpacks it without root.
-        #     Chrome/chromedriver need libnspr4, libnss3, libasound2t64, libgbm1
+        #     Chrome/chromedriver need libnspr4, libnss3, distro-versioned ALSA,
+        #     and libgbm1
         #     which are absent on the slim WSL runner image.
         #  3. Diagnose chromedriver session creation (Chrome's stderr) before wasm-pack.
         run: |
@@ -516,22 +517,77 @@ jobs:
           DEBS_DIR="$DEPS_DIR/debs"
           APT_LISTS="$DEPS_DIR/apt-lists"
           APT_CACHE="$DEPS_DIR/apt-cache"
-          mkdir -p "$DEBS_DIR" "$APT_LISTS/partial" "$APT_CACHE/archives/partial"
-          # Keep every mutable APT path job-local and disable global locks. The
-          # system sources/keyrings and dpkg status remain read-only inputs.
+          readonly APT_SOURCES="$DEPS_DIR/apt-sources"
+          mkdir -p \
+            "$DEBS_DIR" \
+            "$APT_LISTS/partial" \
+            "$APT_CACHE/archives/partial" \
+            "$APT_SOURCES/sources.list.d"
+          # Общие sources раннера содержат посторонние vendor-репозитории.
+          # Недоступный vendor не должен отменять browser-gate, которому нужны
+          # только пакеты дистрибутива, поэтому зависимость объявлена явно.
+          source /etc/os-release
+          : "${ID:?missing distro ID}"
+          : "${VERSION_CODENAME:?missing distro codename}"
+          # Debian 12 / Ubuntu 22.04 predate the time64 package rename; Debian
+          # 13 / Ubuntu 24.04 use the t64 ABI name. Unknown images fail closed
+          # instead of guessing a package from mutable ambient APT metadata.
+          case "$ID:$VERSION_CODENAME" in
+            debian:bookworm|ubuntu:jammy)
+              ALSA_PACKAGE=libasound2
+              ;;
+            debian:trixie|ubuntu:noble)
+              ALSA_PACKAGE=libasound2t64
+              ;;
+            *)
+              echo "unsupported Chrome dependency release: $ID:$VERSION_CODENAME" >&2
+              exit 1
+              ;;
+          esac
+          readonly ALSA_PACKAGE
+          case "$ID" in
+            debian)
+              DISTRO_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
+              test -r "$DISTRO_KEYRING"
+              printf '%s\n' \
+                "deb [signed-by=$DISTRO_KEYRING] https://deb.debian.org/debian $VERSION_CODENAME main" \
+                "deb [signed-by=$DISTRO_KEYRING] https://deb.debian.org/debian $VERSION_CODENAME-updates main" \
+                "deb [signed-by=$DISTRO_KEYRING] https://security.debian.org/debian-security $VERSION_CODENAME-security main" \
+                > "$APT_SOURCES/sources.list"
+              ;;
+            ubuntu)
+              DISTRO_KEYRING=/usr/share/keyrings/ubuntu-archive-keyring.gpg
+              test -r "$DISTRO_KEYRING"
+              printf '%s\n' \
+                "deb [signed-by=$DISTRO_KEYRING] https://archive.ubuntu.com/ubuntu $VERSION_CODENAME main" \
+                "deb [signed-by=$DISTRO_KEYRING] https://archive.ubuntu.com/ubuntu $VERSION_CODENAME-updates main" \
+                "deb [signed-by=$DISTRO_KEYRING] https://security.ubuntu.com/ubuntu $VERSION_CODENAME-security main" \
+                > "$APT_SOURCES/sources.list"
+              ;;
+            *)
+              echo "unsupported Chrome dependency distro: $ID" >&2
+              exit 1
+              ;;
+          esac
+          readonly DISTRO_KEYRING
+          # Все изменяемые пути APT и полный inventory sources принадлежат job;
+          # keyring и dpkg status остаются read-only входами.
           APT_OPTIONS=(
+            -o "Dir::Etc::sourcelist=$APT_SOURCES/sources.list"
+            -o "Dir::Etc::sourceparts=$APT_SOURCES/sources.list.d"
             -o "Dir::State::lists=$APT_LISTS"
             -o "Dir::State::status=/var/lib/dpkg/status"
             -o "Dir::Cache=$APT_CACHE"
             -o "Dir::Cache::archives=$APT_CACHE/archives"
             -o "Debug::NoLocking=1"
             -o "Acquire::Retries=3"
           )
+          readonly APT_OPTIONS
           apt-get "${APT_OPTIONS[@]}" update
           # libnspr4/libnss3: NSS/NSPR crypto deps for Chrome and chromedriver.
-          # libasound2t64: ALSA after the current Debian/Ubuntu time64 transition.
+          # ALSA package: selected above from the explicit supported distro matrix.
           # libgbm1: GPU buffer manager (needed by Chrome headless for DRM/render node).
-          (cd "$DEBS_DIR" && apt-get "${APT_OPTIONS[@]}" download libnspr4 libnss3 libasound2t64 libgbm1 2>&1)
+          (cd "$DEBS_DIR" && apt-get "${APT_OPTIONS[@]}" download libnspr4 libnss3 "$ALSA_PACKAGE" libgbm1 2>&1)
           for deb in "$DEBS_DIR"/*.deb; do
             dpkg --extract "$deb" "$DEPS_DIR"
           done

crates/labcolors-core/contracts/clean-set-srgb8-v1/receipt-v1.json

@@ -55,11 +55,11 @@
       "sha256": "b30300edd3910e3d9da1e56896ce14c3db508b1a6fc5608e01032a5ad95777b1"
     },
     {
-      "bytes": 33725,
+      "bytes": 38648,
       "license": "MIT",
       "path": "crates/labcolors-core/src/observation.rs",
       "role": "observation_runtime_source",
-      "sha256": "90e2ca62acac950fc38e711369a9fd3ef24262f7776f1e8ed2aeac92733a4911"
+      "sha256": "aeed8f9c92050a33a9c867c6b43cec2bc8869ff01bddab03f3b743e74034c616"
     },
     {
       "bytes": 7951,
@@ -69,32 +69,32 @@
       "sha256": "ec6585496208972e183d3a5bcd1f67bae4d89cc8e6a797d9c6443d8e0754502b"
     },
     {
-      "bytes": 46758,
+      "bytes": 46204,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program/attachment.rs",
       "role": "point_attachment_source",
-      "sha256": "721fa5852a400184908a2751f2caab782d6a88cb16bf6e64d5ff0f4d4867fc74"
+      "sha256": "172fa95ca1a4508c149c1ec0905baa7d1f93195e63a7574d4ed4b133e50099cc"
     },
     {
-      "bytes": 25241,
+      "bytes": 35617,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program/attachment/support.rs",
       "role": "point_attachment_test_support",
-      "sha256": "2ea5dc94f3a101428947ad34dc64cb9fbc7a5a7b666b6795ab837540f98aa7e1"
+      "sha256": "993eaeee68fd0439d734daa8e9cfa7d5add658b65a2a9ca63878c97fbd175121"
     },
     {
-      "bytes": 54584,
+      "bytes": 67914,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program/attachment/tests.rs",
       "role": "point_attachment_tests",
-      "sha256": "1a45dafe529c0855b7cabc054b94d096c661e81243d2a80d78f740bcb595d105"
+      "sha256": "a0838361c5b82c17766af1c8175f9ed2fca9d483a50ebe1aab80ee3ef3690e86"
     },
     {
-      "bytes": 162073,
+      "bytes": 162822,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program.rs",
       "role": "program_facade_source",
-      "sha256": "1f8e732bf70876cbc69ddfaf2503a682bdf1e2881f3655961386c2472d875976"
+      "sha256": "62572c59cdc16e0e809d662b11e9d90ea658ef63c70c34962016ee3f39efc20e"
     },
     {
       "bytes": 71522,
@@ -104,11 +104,11 @@
       "sha256": "8f0366079e6fa0006360ab19b0449e622add48fdb08431a02258236e1371d78a"
     },
     {
-      "bytes": 159952,
+      "bytes": 168354,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program_session.rs",
       "role": "program_source",
-      "sha256": "4768f1dbfd564b1f1b21bbb02d20cc0213a2f12ebca9a9939129cf62fdd9fd3b"
+      "sha256": "6b418c3988626c7037479feed1047134e3209e59c7c5c65b5d3ad9cbdeaa38d9"
     },
     {
       "bytes": 21546,
@@ -125,11 +125,11 @@
       "sha256": "aa6aa7c0b630437f1c1ba8c2ceafb0dadf6551c42331559504076a6cd44e6331"
     },
     {
-      "bytes": 21061,
+      "bytes": 26928,
       "license": "MIT",
       "path": "crates/labcolors-core/src/session.rs",
       "role": "session_runtime_source",
-      "sha256": "faf5bdffa7bc82a17d4ead99d34f1a22c24b0b511e253e8280ded86629c24e2e"
+      "sha256": "c7a1706ad4837adfdfbe58a302d20b613912530ebff260fd877a47210b02ef46"
     },
     {
       "bytes": 34105,

crates/labcolors-core/contracts/clean-set-srgb8-v1/receipt-v1.sha256

@@ -1 +1 @@
-644195947c48b841dd319e7586700986ddf4fd4553d593d093c4e109a3002fe3  receipt-v1.json
+1406927aee9111525cd36c809e91f115c14a4db48e346759130f00b0c9414640  receipt-v1.json