chromium 151 needs libXtst.so.6 — add libxi + libxtst packages (unblocks #420 check)

[bryan-minimal]

#420 (chromium 147→151) builds green but fails its build-dependent standalone check: chromium 151's amd64 chrome binary hard-links libXtst.so.6, which no package in the tree provides, so chromium --version (and agent-browser's open_check) exit 127 at load time:

[amd64/check] FAIL chromium-bin :: smoketest: /bin/chromium --version had exit code 127
  .../chromium-1233/chrome-linux64/chrome: error while loading shared libraries:
  libXtst.so.6: cannot open shared object file: No such file or directory

Diagnosis

• The amd64 chrome (from the chromium snapshot bucket) hard-links libXtst.so.6 in its DT_NEEDED. The arm64 chrome (Playwright CDN build) does not — its 32 needed libs are all already in the closure. So this is specific to the amd64 leg, and likely latent in 147 too (libXtst is a standard Chrome-on-Linux dep; 147's check just never tripped it).
• No libxtst package exists in the tree, and its dependency libxi is also missing.
• This is not a resolver bug — the auto-updater (pkgmgr#518) bumps version + shas byte-perfectly; it deliberately does not re-derive the ELF runtime closure. A major browser bump can grow its shared-lib deps, and the build-dependent check is exactly the safety net that caught it.

Fix — add two X.org packages + wire one runtime_dep

Both are standard autotools X.org libs; model on packages/libxext (same build.sh: ./configure --prefix=/usr --disable-static && make && make install). Tarballs are already mirrored to gs://minimal-staging-archives/.

packages/libxi — version = "1.8.3"

• source: gs://minimal-staging-archives/libXi-1.8.3.tar.xz (mirrored ✓)
• sha256 = "7ad60056f01af4f786cfe93b3a7707447711626fc8da2637bec71a90409babe5"
• runtime_deps: libx11, libxext, libxfixes, glibc (from libXi-1.8.3 Requires.private: x11 xext xfixes)
• outputs: usr/lib/libXi.so* (OutputLib) + includes + pkgconfig; license_spdx = "MIT"

packages/libxtst — version = "1.2.5"

• source: gs://minimal-staging-archives/libXtst-1.2.5.tar.xz (mirrored ✓)
• sha256 = "b50d4c25b97009a744706c1039c598f4d8e64910c9fde381994e1cae235d9242"
• runtime_deps: libx11, libxext, libxi, glibc (from libXtst-1.2.5 Requires.private: x11 xext … xi)
• outputs: usr/lib/libXtst.so* (OutputLib) + includes + pkgconfig; license_spdx = "MIT"

packages/chromium-bin/build.ncl: add libxtst to runtime_deps (+ its import). This transitively pulls libxi → libXfixes (already present), so both libXtst.so.6 and libXi.so.6 land in the closure. chromium-headless-shell-bin passed its check, so it needs no change unless a rebuild says otherwise.

Already done (WIP staged locally in worktree pkgs-chromium-libxtst on the chromium-151-manual branch — not committed/pushed)

• Both tarballs downloaded from x.org, sha'd, and mirrored to gs://minimal-staging-archives/.
• packages/libxi + packages/libxtst build.ncl + build.sh written; libxtst wired into chromium-bin runtime_deps.
• Both libs build locally (minimal package --rebuild, exit 0, real trees): libXi.so.6.1.0, libXtst.so.6.1.0. Confirmed libXtst.so.6 DT_NEEDED includes libXi.so.6 (the transitive dep works).

Remaining

1. Verify the amd64 151 chrome's FULL DT_NEEDED has no gaps beyond libXtst/libXi (the loader only reports the first missing lib). The amd64 chrome-linux.zip (snapshot 1654408) is extracted locally for this readelf; the arm64 147 build needed 32 libs, all covered.
2. Commit libxi + libxtst + the chromium-bin runtime_deps change to chromium: 147.0.7727.15 -> 151.0.7922.19 (clears ~63 Critical CVEs) #420 and rebuild — the buildbot's standalone check is the final proof.

Note (tool follow-up, optional)

A major version bump that grows the runtime closure will always need this manual step for prebuilt-binary packages. If it recurs, pkgmgr's resolver could ldd-diff the fetched binary against the declared closure and flag/emit the missing runtime_deps (like import-wolfi --from-build does for source packages). Out of scope here.

[bryan-minimal]

Fixed in #420 (commit b3dac0b): added packages/libxi (1.8.3) + packages/libxtst (1.2.5) and wired libxtst into chromium-bin's runtime_deps (it pulls libxi transitively).

Definitive closure check: readelf of the amd64 151 chrome binary shows 33 DT_NEEDED libs — all covered, with libXtst.so.6 the only addition over the 147 build. chrome doesn't link libXi directly; libXtst does (Requires.private: x11 xext xi), so one dep closes the whole closure — no further missing libs. headless-shell passed its check (its binary doesn't link libXtst), so it's unchanged.

Both libs built locally (real libXi.so.6 / libXtst.so.6 trees); tarballs mirrored to gs://minimal-staging-archives. Pending the buildbot rebuild of #420 to confirm the standalone check now passes — will close this once it's green.