build(ui): build core.wasm in CI, stop committing the binary (F6)

core.wasm and wasm_exec.js are no longer tracked (untracked + gitignored).
A reusable composite action .gitea/actions/build-wasm installs TinyGo
(actions/cache'd) and runs `make -C ui wasm`; it runs in all three
frontend-building workflows — ui-test (before Playwright; Vitest uses the
fake Core and needs no build), dev-deploy, and prod-build. ui-test gains a
Go setup (TinyGo shells out to Go); the deploy workflows already had one.

Docs: ui/docs/wasm-toolchain.md, ui/README.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/actions/build-wasm/action.yml

@@ -0,0 +1,33 @@
+name: Build core.wasm
+description: >-
+  Install TinyGo (cached) and build ui/core to frontend/static/core.wasm
+  and wasm_exec.js via `make -C ui wasm`. The binaries are no longer
+  committed, so every workflow that builds or serves the frontend bundle
+  (ui-test, dev-deploy, prod-build) runs this first. Requires Go to be
+  set up by the caller — TinyGo shells out to the Go toolchain.
+
+runs:
+  using: composite
+  steps:
+    - name: Restore TinyGo cache
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/galaxy-tinygo
+        key: tinygo-0.41.1-linux-amd64
+
+    - name: Install TinyGo
+      shell: bash
+      run: |
+        set -euo pipefail
+        version="0.41.1"
+        root="$HOME/.cache/galaxy-tinygo/tinygo"
+        if [ ! -x "$root/bin/tinygo" ]; then
+          mkdir -p "$HOME/.cache/galaxy-tinygo"
+          curl -fsSL "https://github.com/tinygo-org/tinygo/releases/download/v${version}/tinygo${version}.linux-amd64.tar.gz" \
+            | tar -xz -C "$HOME/.cache/galaxy-tinygo"
+        fi
+        echo "$root/bin" >> "$GITHUB_PATH"
+
+    - name: Build core.wasm
+      shell: bash
+      run: make -C ui wasm

.gitea/workflows/dev-deploy.yaml

@@ -70,6 +70,9 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Build UI frontend
         working-directory: ui/frontend
         env:

.gitea/workflows/prod-build.yaml

@@ -87,6 +87,9 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Build UI bundle
         working-directory: ui/frontend
         env:

.gitea/workflows/ui-test.yaml

@@ -61,6 +61,15 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.work
+          cache: true
+
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Install Playwright browsers
         # `--with-deps` would shell out to `sudo apt-get install` for
         # the system .so libraries, which the host-mode runner cannot