ci: build the patched engine, not just check that the series applies

[jonathanKingston]

ci.yml builds against stock libservo, and its patch series applies job
proves servo-patches/ still applies. Nothing compiles the result — so the
README's "Using a patched Servo" recipe is verified as far as git am and no
further. This adds a Linux job that follows the recipe end to end and builds
what it produces.

How it stays honest

The override block is lifted out of README step 3, not restated here. The
paths in it are relative to the workspace root, which is exactly where the
block gets appended, so cloning the engine crates as siblings of the checkout
makes the documented paths work verbatim. CI builds the block the README
hands a consumer; edit the recipe and CI follows it.

Which repositories get checked out is read out of that block too. Every
path = "../<dir>/..." is a checkout to build; anything overridden by git rev
is cargo's to fetch. That distinction is live rather than hypothetical:
content-security-policy has been both — patch files here until #2 moved its
fixes to a fork branch — and check-patch-series.sh now handles either
arrangement for the same reason. Hardcoding today's two checkouts would mean
this quietly building the wrong thing the next time one moves. An override by
path with no recipe fails, and so does one whose patch glob matches nothing:
patching a pristine checkout would build something indistinguishable from
stock while reporting success.

Nothing new is pinned. Revisions come from Cargo.lock via
.cargo_vcs_info.json, the same route check-patch-series.sh takes. The two
scripts duplicate those ~20 lines rather than sharing them, to stay out of
#9's way; worth factoring out once that lands.

What it catches that nothing else does

patched-servo exists to set layout_svg_native_enabled, a pref only patch
0009 provides. A series that still applies but has lost that pref passes every
other job in this repository and fails here.

Cost, and the knobs

Linux only, uncached, 13m54s cold on the first run — comparable to
ci.yml's own Linux build. No Swatinem/rust-cache: a fourth multi-gigabyte
entry would evict the per-platform caches every pull request depends on, to
warm a job that runs a few times a month. Disk was never close: 84 GB free on
the runner, servo's checkout 1.6 GB.

Triggers are the series, the manifests, README.md (the block is read out of
it), and the toolchain pin — plus weekly and workflow_dispatch. src/** is
deliberately not a trigger, so a change to the feature-gated block in
src/servo/embedder.rs is only caught by the weekly run. Easy to tighten if
that trade looks wrong.

Verification

Run locally against a scratch copy of the tree:

scenario	result
today's README (csp by fork rev)	servo 24/24, stylo 5/5; csp correctly not checked out
the pre-#2 arrangement (csp by path + csp-*.patch)	csp 1/1 at 05528760, servo 24/24, stylo 5/5
cargo generate-lockfile with the block applied	986 packages, exit 0 — all ten overrides live, no "patch was not used" warnings
override naming a repo with no recipe	fails before any clone
path override whose patches have vanished	fails before any clone

And the job itself has now run on this pull request — all ten steps green in
13m54s. The log confirms it built the patched engine rather than the
registry one: every component resolved to the local checkout, e.g.
Adding servo v0.5.0 (/home/runner/work/tauri-runtime-servo/servo/components/servo)
and selectors v0.40.0 (…/stylo/selectors). Both the --lib build and the
example link succeeded.

🤖 Generated with Claude Code