feat(linux/build): run diffoscope inside silvermetal-builder + tail diff to log (M1.1 iter25)

Run #4272 hit the M1.1 reproducibility gate as designed — both builds
completed, ISOs differed (A=ff2e7444…, B=9ec7f3da…), diagnose-divergence
fired. Two things stopped that diagnostic from being useful:

1. **diffoscope wasn't available.** diagnose-divergence.sh runs in the
   catthehacker job container, which has cmp but no diffoscope. The
   silvermetal-builder image we built two minutes earlier *does* have
   diffoscope-minimal (Dockerfile.builder line 109). Run the diagnostic
   inside that image: docker run --volumes-from $self_cid + the digest
   the builder-image job passed in via BUILDER_IMAGE. Mounts the same
   /workspace path so REPO_ROOT-relative resolution in
   diagnose-divergence.sh works unchanged.

2. **The artifact was unreachable.** actions/upload-artifact@v3 against
   Gitea 1.25.2 reports "successfully uploaded" but the
   /api/v1/repos/.../actions/runs/{id}/artifacts list comes back empty,
   and every download path probed returns 404. Known v3 incompatibility
   — v3 uses the legacy GitHub Services API endpoint that Gitea
   doesn't expose for retrieval.

   Workaround: tail the divergence content into the workflow log
   directly, so it shows up in `gitea actions logs` regardless of
   upload-artifact's behaviour. Specifically: sizes.txt, sha256.txt,
   checklist.md, head -n 400 of diff.txt (or cmp.txt as fallback).
   That's enough to see what's diverging without needing the artifact.
   Upload-artifact step kept in place for whenever Gitea's API gets
   sorted (fix-once-then-forget).

The self-discovery loop (docker ps + inspect filtering by
/workspace/SilverLABS/SilverMetal mount destination) is the same one
build.sh uses; concurrency: 1 in this workflow guarantees a single
match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-linux.yaml

@@ -150,10 +150,69 @@ jobs:
           echo "iso_sha256=${A}" >> "${GITHUB_OUTPUT}"
           if [ "${A}" != "${B}" ]; then
             echo "::error::ISO SHA256 mismatch — A=${A} B=${B}"
-            ISO_A="$(ls "${{ github.workspace }}/build-a"/*.iso | head -n1)" \
-            ISO_B="$(ls "${{ github.workspace }}/build-b"/*.iso | head -n1)" \
-            REPORT_DIR="${{ github.workspace }}/divergence" \
-              linux/build/scripts/diagnose-divergence.sh
+
+            # The catthehacker job container has cmp but not diffoscope.
+            # We do have the silvermetal-builder image (with
+            # diffoscope-minimal baked in via Dockerfile.builder) on the
+            # host docker daemon — built fresh at the top of this run by
+            # the builder-image job. Run diagnose-divergence inside that
+            # image so we get the rich, package-aware diff. Mount the
+            # workspace at the same path so REPO_ROOT-relative resolution
+            # in diagnose-divergence.sh works.
+            ISO_A="$(ls "${{ github.workspace }}/build-a"/*.iso | head -n1)"
+            ISO_B="$(ls "${{ github.workspace }}/build-b"/*.iso | head -n1)"
+            mkdir -p "${{ github.workspace }}/divergence"
+
+            SELF_CID=""
+            for cid in $(docker ps -q --no-trunc 2>/dev/null); do
+              if docker inspect "$cid" --format \
+                  '{{range .Mounts}}{{if eq .Destination "/workspace/SilverLABS/SilverMetal"}}match{{end}}{{end}}' \
+                  2>/dev/null | grep -q match; then
+                SELF_CID="$cid"; break
+              fi
+            done
+            if [ -n "${SELF_CID}" ]; then
+              docker run --rm \
+                --volumes-from "${SELF_CID}" \
+                -e ISO_A="${ISO_A}" \
+                -e ISO_B="${ISO_B}" \
+                -e REPORT_DIR="${{ github.workspace }}/divergence" \
+                --entrypoint /bin/bash \
+                "${BUILDER_IMAGE}" \
+                "${{ github.workspace }}/linux/build/scripts/diagnose-divergence.sh" \
+                || true
+            else
+              echo "::warning::Could not find self container, falling back to host cmp"
+              ISO_A="${ISO_A}" ISO_B="${ISO_B}" \
+                REPORT_DIR="${{ github.workspace }}/divergence" \
+                linux/build/scripts/diagnose-divergence.sh || true
+            fi
+
+            # Tail key signal directly into the workflow log so we see it
+            # without needing artifact download (Gitea 1.25's API doesn't
+            # surface upload-artifact@v3 payloads through any v1 endpoint
+            # we've found). Print: file size diff, the checklist, and the
+            # first few hundred lines of the diffoscope text report.
+            echo ""
+            echo "=== Divergence: ISO sizes ==="
+            cat "${{ github.workspace }}/divergence/sizes.txt" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: SHA256 ==="
+            cat "${{ github.workspace }}/divergence/sha256.txt" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: checklist ==="
+            cat "${{ github.workspace }}/divergence/checklist.md" 2>/dev/null || true
+            echo ""
+            echo "=== Divergence: diffoscope (first 400 lines of diff.txt) ==="
+            head -n 400 "${{ github.workspace }}/divergence/diff.txt" 2>/dev/null || true
+            if [ ! -f "${{ github.workspace }}/divergence/diff.txt" ] \
+                && [ -f "${{ github.workspace }}/divergence/cmp.txt" ]; then
+              echo "=== Divergence: cmp -l (first 50 differing bytes) ==="
+              head -n 50 "${{ github.workspace }}/divergence/cmp.txt" 2>/dev/null || true
+            fi
+            echo ""
+            echo "(Full report uploaded as divergence-report-${{ github.run_id }})"
+
             exit 1
           fi
           echo "Reproducibility gate PASSED at ${A}"