build: key the reference CLI's target dir by the pinned revision

The reference renderer was a revision behind for three consecutive diff runs and
nothing said so.

After the pin bump, `build-reference-cli` reported success at rev b436e5a and
`verify-screen` showed main_menu jumping 3/255 -> 72/255. The natural reading was
that the port had regressed. It had not: the port was right and the REFERENCE was
stale. The shared CARGO_TARGET_DIR still held a `sylpheed-cli` built from
47f423f, cargo said "Finished in 0.13s" and left it there. A clean target dir
built a binary resolving ptframe1 to (440,108) t=62; the shared one still said
(620,108) t=16.

The old check -- does `screen list` run -- cannot catch this. A stale binary runs
perfectly.

So: build into `$CARGO_TARGET_DIR/reference-cli/$rev`, keyed by the pin, where a
new revision has no artifacts to reuse. Then verify the binary AGAINST export/:
both come from the same pin, so if the CLI resolves ptframe1's rest differently
from what the exporter wrote, the two halves of the verification are not the same
revision and it fails loudly. It compares the two rather than asserting a
literal, so it stays true when the pin moves again.

docker/bin is baked into the image, so this needs an image rebuild to reach
PATH; until then invoke the repo copy by path.

tools/verify-screen

@@ -35,7 +35,10 @@
 set -euo pipefail
 cd "${PROJECT_DIR:-/work}"
 
-CLI="${SYLPHEED_CLI:-${CARGO_TARGET_DIR:-/sylph-home/port/target-container}/release/sylpheed-cli}"
+# `reference-cli/`, not `release/`: the reference binary is built per pinned
+# revision so a pin change cannot silently reuse the previous revision's build.
+# See docker/bin/build-reference-cli.
+CLI="${SYLPHEED_CLI:-${CARGO_TARGET_DIR:-/sylph-home/port/target-container}/reference-cli/sylpheed-cli}"
 DISC="${SYLPHEED_DISC:-/disc}"
 OUT="${OUT:-${TMPDIR:-/tmp}/verify-screen}"
 export DISPLAY="${DISPLAY:-:97}"