Fix install guard glob check and tighten Docker ldd verification

Three follow-up cleanups from re-reviewing the previous three fix commits:

1. ci.yml install guard. The previous guard used
     ! ls /usr/bin/clang-format-diff-* 2>/dev/null | head -1
   which always evaluated as "tool present" because the pipeline exit
   code is dominated by `head` (returns 0 even on empty input). The
   guard would never trip even when no clang-format-diff binary
   existed; the fast-fail intent was lost (the runtime DIFFCMD lookup
   would still catch it, but later in the workflow). Replace with
   `compgen -G` which actually fails on a glob miss.

2. Dockerfile ldd verification. `ldd` returns 0 even when shared
   libraries are reported as "not found", so the previous step proved
   nothing. Grep for "not found" and exit 1 on hit. Also clarify the
   slang-static-by-default note since the libslang*.so* glob may
   legitimately match nothing.

3. fuzz_sdc.cpp had an unused <cstring> include left over from an
   earlier draft. Remove it.

No regression -- ctest 504/504 still passes.

Author: babyworm

.github/workflows/ci.yml

@@ -20,13 +20,15 @@ jobs:
         run: |
           sudo apt-get update
           # Ubuntu's clang-format package ships /usr/bin/clang-format-diff,
-          # but we install the version-suffixed -diff tool too in case the
-          # runner image rotates the unversioned symlink.
+          # but the version-suffixed binaries (clang-format-diff-NN) come
+          # with the corresponding clang-format-NN package on some images.
           sudo apt-get install -y clang-format
           # Locate clang-format-diff; fail loudly if absent so the format
           # gate cannot silently succeed when the tool is missing.
+          # Using compgen -G avoids the "ls | head" pipeline whose exit code
+          # is dominated by `head` (always 0), which would mask a glob miss.
           if ! command -v clang-format-diff >/dev/null 2>&1 \
-            && ! ls /usr/bin/clang-format-diff-* 2>/dev/null | head -1; then
+            && ! compgen -G '/usr/bin/clang-format-diff-*' >/dev/null; then
             echo "::error::clang-format-diff not found after apt install; the format gate cannot run."
             exit 1
           fi

Dockerfile

@@ -41,17 +41,26 @@ RUN cmake -B build \
         -DSVLENS_FETCH_DEPS=OFF \
     && cmake --build build -j"$(nproc)" \
     && cmake --install build --prefix /usr/local \
-    && ldd /usr/local/bin/svlens \
-    && /usr/local/bin/svlens --version
+    && /usr/local/bin/svlens --version \
+    && if ldd /usr/local/bin/svlens | grep -q 'not found'; then \
+           echo 'ERROR: svlens has unresolved dynamic dependencies'; \
+           ldd /usr/local/bin/svlens; \
+           exit 1; \
+       fi
 
 # Stage the runtime payload at a known path so the final stage uses an
-# explicit allow-list rather than copying /usr/local/lib wholesale.
+# explicit allow-list rather than copying /usr/local/lib wholesale. With
+# scripts/setup-deps.sh's default config slang builds STATIC, so the
+# libslang*.so* glob may not match anything; that is expected and the
+# binary is self-contained for slang. The libsvlens*.so* glob is kept as
+# a forward guard in case a future cmake target ever produces a shared
+# library.
 RUN install -d /runtime/usr/local/bin /runtime/usr/local/lib \
     && install -m 0755 /usr/local/bin/svlens /runtime/usr/local/bin/svlens \
     && for lib in /usr/local/lib/libslang*.so* /usr/local/lib/libsvlens*.so*; do \
            [ -e "$lib" ] && cp -a "$lib" /runtime/usr/local/lib/ || true; \
        done \
-    && ls -la /runtime/usr/local/lib/
+    && ls -la /runtime/usr/local/bin/ /runtime/usr/local/lib/
 
 # ---- runtime ---------------------------------------------------------------
 FROM ${DEBIAN_BASE} AS runtime

fuzz/fuzz_sdc.cpp

@@ -16,7 +16,6 @@
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
-#include <cstring>
 #include <filesystem>
 #include <string>
 #include <unistd.h>