ci: install protoc for the sp1-sdk jobs

sp1-sdk compiles protobuf definitions for its network prover, so the
prover-backends/sp1 and harness/sp1 clippy jobs need protoc. The
verifier-only sp1 job deliberately does not: verification pulls
sp1-verifier rather than sp1-sdk, which is what keeps the stored-fixture
job free of a guest ELF, proving key, and Docker. Document the same in
the README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 0xwonj

.github/workflows/ci.yml

@@ -61,12 +61,16 @@ jobs:
             args: -p ghostpool-verifier-backends --features native-reference
           - name: prover-backends/sp1
             args: -p ghostpool-prover-backends --features sp1
+            # sp1-sdk builds prost protobuf definitions for the network prover.
+            protoc: true
           - name: validator/mock+sp1
             args: -p ghostpool-validator --features mock,verifier-sp1
           - name: client/json-rpc
             args: -p ghostpool-client --features json-rpc
           - name: harness/sp1
             args: -p ghostpool-harness --features sp1
+            # pulls prover-backends/sp1, hence sp1-sdk, hence protoc.
+            protoc: true
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
@@ -76,6 +80,11 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ matrix.name }}
+      # Only the sp1-sdk-dependent jobs need protoc. The verifier-only sp1 job
+      # deliberately does not: verification pulls sp1-verifier, not sp1-sdk,
+      # which is what keeps the stored-fixture job cheap.
+      - if: matrix.protoc
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
       # clippy rather than check, so feature-gated code is linted too.
       - run: cargo clippy --all-targets --locked ${{ matrix.args }} -- -D warnings
 

README.md

@@ -139,6 +139,21 @@ cargo clippy --workspace --all-targets -- -D warnings
 cargo test --workspace --all-targets
 ```
 
+Building anything that pulls `sp1-sdk` (the `sp1` feature of
+`ghostpool-prover-backends`, and therefore of `ghostpool-harness`) additionally
+needs `protoc`, because the SDK compiles protobuf definitions for its network
+prover:
+
+```bash
+sudo apt-get install -y protobuf-compiler   # Debian/Ubuntu
+```
+
+Verification does not: `ghostpool-verifier-backends`'s `sp1` feature pulls only
+`sp1-verifier`. That is what lets the committed proof fixtures
+(`crates/verifier-backends/tests/fixtures/`) be checked in CI without a guest
+ELF, a proving key, or Docker. See
+[docs/design/ci-and-proof-fixtures.md](docs/design/ci-and-proof-fixtures.md).
+
 ## Harness Artifacts
 
 The lean harness expands a TOML config into an explicit run plan, executes it