build: key the reference CLI's target dir by the pinned revision

The reference renderer was a revision behind for three consecutive diff runs and
nothing said so.

After the pin bump, `build-reference-cli` reported success at rev b436e5a and
`verify-screen` showed main_menu jumping 3/255 -> 72/255. The natural reading was
that the port had regressed. It had not: the port was right and the REFERENCE was
stale. The shared CARGO_TARGET_DIR still held a `sylpheed-cli` built from
47f423f, cargo said "Finished in 0.13s" and left it there. A clean target dir
built a binary resolving ptframe1 to (440,108) t=62; the shared one still said
(620,108) t=16.

The old check -- does `screen list` run -- cannot catch this. A stale binary runs
perfectly.

So: build into `$CARGO_TARGET_DIR/reference-cli/$rev`, keyed by the pin, where a
new revision has no artifacts to reuse. Then verify the binary AGAINST export/:
both come from the same pin, so if the CLI resolves ptframe1's rest differently
from what the exporter wrote, the two halves of the verification are not the same
revision and it fails loudly. It compares the two rather than asserting a
literal, so it stays true when the pin moves again.

docker/bin is baked into the image, so this needs an image rebuild to reach
PATH; until then invoke the repo copy by path.

docker/bin/build-reference-cli

@@ -36,10 +36,45 @@ if [ -z "$src" ]; then
 fi
 [ -n "$src" ] || { echo "build-reference-cli: no checkout for rev $rev" >&2; exit 1; }
 
+# Build into a target directory KEYED BY THE REVISION.
+#
+# This is not tidiness. Sharing one target dir across pins silently served a
+# stale binary: after the pin moved 8b6dbcf -> 5414db3, cargo reported
+# "Finished in 0.13s" and left in place a `sylpheed-cli` built from the OLD
+# decoders. `screen list` still worked, so the old check passed, and the
+# reference renderer this whole project verifies against was a revision behind
+# for three consecutive diff runs. A per-rev tree cannot do that: a new pin has
+# no artifacts to reuse.
 echo "build-reference-cli: building sylpheed-cli from $rev"
-cargo build --release --manifest-path "$src/Cargo.toml" -p sylpheed-cli
+tree="$CARGO_TARGET_DIR/reference-cli/$rev"
+CARGO_TARGET_DIR="$tree" cargo build --release --manifest-path "$src/Cargo.toml" -p sylpheed-cli
 
-out="$CARGO_TARGET_DIR/release/sylpheed-cli"
-"$out" screen list "${SYLPHEED_DISC:-/disc}/dat/GP_TITLE.pak" >/dev/null \
+stable="$CARGO_TARGET_DIR/reference-cli/sylpheed-cli"
+mkdir -p "$(dirname "$stable")"
+cp -f "$tree/release/sylpheed-cli" "$stable"
+
+"$stable" screen list "${SYLPHEED_DISC:-/disc}/dat/GP_TITLE.pak" >/dev/null \
   || { echo "build-reference-cli: built, but 'screen list' failed" >&2; exit 1; }
-echo "build-reference-cli: $out  (rev $rev, 'screen' subcommand present)"
+
+# And check the binary is actually the pinned code, not merely a working one.
+# `screen info` prints each element's resting placement, which is decoder
+# output; if this disagrees with what the exporter wrote from the same pin, the
+# two halves of the verification are not the same revision and every diff below
+# is meaningless. Compare rather than assert a value, so this stays true when
+# the pin moves again.
+if [ -f "${PROJECT_DIR:-/work}/export/screens/title/main_menu.json" ]; then
+  cli_rest=$("$stable" screen info "${SYLPHEED_DISC:-/disc}/dat/GP_TITLE.pak" --build 5 \
+             | sed -n 's/.*ptframe1\.t32.*rest (\([0-9]*\),\([0-9]*\)).*/\1,\2/p')
+  exp_rest=$(python3 -c '
+import json,sys
+d=json.load(open(sys.argv[1]))
+e=next(e for e in d["elements"] if e["id"]=="ptframe1")
+print("%d,%d" % tuple(e["rest"]["pos"]))' "${PROJECT_DIR:-/work}/export/screens/title/main_menu.json")
+  if [ "$cli_rest" != "$exp_rest" ]; then
+    echo "build-reference-cli: STALE OR MISMATCHED BINARY" >&2
+    echo "  the CLI resolves ptframe1 rest to ($cli_rest) but export/ says ($exp_rest)." >&2
+    echo "  Both should come from rev $rev. Delete $tree and rebuild." >&2
+    exit 1
+  fi
+fi
+echo "build-reference-cli: $stable  (rev $rev, agrees with export/ on ptframe1)"