docker: fix build-export for the subcommand, and build the reference CLI at the pin

Two tooling fixes, both needed before P1 can diff anything.

`build-export` was calling `sylpheed-export --disc ... --out export`, which P0
broke when it moved the exporter behind `export` / `check` subcommands. It is a
regression from f6fc269 and this is the fix. It now also runs `check` after
exporting, because `export` writes a tree and `check` is the only thing that
says the tree is readable by something other than the program that wrote it.

`build-reference-cli` is new. `sylpheed-cli screen render` is the reference the
Godot port gets diffed against, and the only copy of it in the container is
/reborn/target/release, which has two problems: the release binary predates the
`screen` subcommand entirely, and /reborn is a LIVE mount of the other agent's
working tree -- it moved from d69272e to 51096ae during a single iteration. A
reference renderer that runs different decoders than the exporter puts a free
variable in every pixel diff, so this builds the CLI from the same pinned
revision the exporter uses and drops it on the persistent target volume.

Both are COPY'd into the image at Dockerfile:76, so neither takes effect in a
running container until the image is rebuilt. The reference CLI is already built
into the target volume by hand, so P1 is not blocked in the meantime.

docker/bin/build-reference-cli

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Build `sylpheed-cli` from the SAME revision of sylpheed-formats the exporter
+# is pinned to, and put it on the persistent target volume.
+#
+#   build-reference-cli       -> $CARGO_TARGET_DIR/release/sylpheed-cli
+#
+# Why not just use /reborn/target/release/sylpheed-cli: that binary is built
+# from whatever /reborn's working tree is at, which is a LIVE mount of the other
+# agent's checkout and moves under you mid-iteration. `sylpheed-cli screen
+# render` is the reference the Godot port is diffed against, so if it runs
+# different decoders than the exporter, a pixel disagreement has a free variable
+# in it and proves nothing about the port.
+#
+# The pinned source lives in CARGO_HOME, which is on the container overlay and
+# does not survive a fresh container -- cargo re-fetches it. The BINARY goes to
+# CARGO_TARGET_DIR, which is a volume, so this is a one-off per image.
+#
+# Jobs are capped for the same reason as build-export.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-3}"
+
+rev=$(sed -n 's/.*Syplheed-Reborn\.git", rev = "\([0-9a-f]*\)".*/\1/p' \
+      crates/sylpheed-export/Cargo.toml | head -1)
+[ -n "$rev" ] || { echo "build-reference-cli: no rev pin found in Cargo.toml" >&2; exit 1; }
+
+# The checkout only exists once cargo has fetched it; a fresh container has not.
+find_checkout() {
+  find "${CARGO_HOME:?}/git/checkouts" -maxdepth 2 -type d -name "${rev}*" 2>/dev/null | head -1
+}
+src=$(find_checkout)
+if [ -z "$src" ]; then
+  echo "build-reference-cli: fetching the pinned decoders ($rev)"
+  cargo fetch
+  src=$(find_checkout)
+fi
+[ -n "$src" ] || { echo "build-reference-cli: no checkout for rev $rev" >&2; exit 1; }
+
+echo "build-reference-cli: building sylpheed-cli from $rev"
+cargo build --release --manifest-path "$src/Cargo.toml" -p sylpheed-cli
+
+out="$CARGO_TARGET_DIR/release/sylpheed-cli"
+"$out" screen list "${SYLPHEED_DISC:-/disc}/dat/GP_TITLE.pak" >/dev/null \
+  || { echo "build-reference-cli: built, but 'screen list' failed" >&2; exit 1; }
+echo "build-reference-cli: $out  (rev $rev, 'screen' subcommand present)"