fix(docker,ci): use bundled-z3 everywhere and add libclang-dev for bindgen

Switch all CLI builds to bundled-z3 (compile z3 from source) instead
of relying on system libz3-dev. This is required because:
- Linux musl CLI builds cannot link against glibc libz3.so
- macOS cross-compilation has no system z3 available
- Distributable Python wheels should not depend on runtime libz3

Add libclang-dev to all CLI Dockerfiles since z3-sys uses bindgen
which requires libclang at compile time.

Add openshell-prover to the sed workspace scope in both release
workflows so Cargo can resolve the path dependency from openshell-cli.

Author: johntmyers

.github/workflows/release-dev.yml

@@ -211,7 +211,7 @@ jobs:
           # Remove workspace members that are not needed for openshell-cli.
           # This avoids Cargo feature-unification pulling in aws-lc-sys (via
           # russh in openshell-sandbox / openshell-server).
-          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-cli", "crates/openshell-core", "crates/openshell-bootstrap", "crates/openshell-policy", "crates/openshell-providers", "crates/openshell-tui"]|' Cargo.toml
+          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-cli", "crates/openshell-core", "crates/openshell-bootstrap", "crates/openshell-policy", "crates/openshell-prover", "crates/openshell-providers", "crates/openshell-tui"]|' Cargo.toml
 
       - name: Patch workspace version
         if: needs.compute-versions.outputs.cargo_version != ''
@@ -220,7 +220,7 @@ jobs:
           sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ needs.compute-versions.outputs.cargo_version }}"'"/}' Cargo.toml
 
       - name: Build ${{ matrix.target }}
-        run: mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-cli
+        run: mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-cli --features bundled-z3
 
       - name: sccache stats
         if: always()

.github/workflows/release-tag.yml

@@ -233,7 +233,7 @@ jobs:
           # Remove workspace members that are not needed for openshell-cli.
           # This avoids Cargo feature-unification pulling in aws-lc-sys (via
           # russh in openshell-sandbox / openshell-server).
-          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-cli", "crates/openshell-core", "crates/openshell-bootstrap", "crates/openshell-policy", "crates/openshell-providers", "crates/openshell-tui"]|' Cargo.toml
+          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-cli", "crates/openshell-core", "crates/openshell-bootstrap", "crates/openshell-policy", "crates/openshell-prover", "crates/openshell-providers", "crates/openshell-tui"]|' Cargo.toml
 
       - name: Patch workspace version
         if: needs.compute-versions.outputs.cargo_version != ''
@@ -242,7 +242,7 @@ jobs:
           sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ needs.compute-versions.outputs.cargo_version }}"'"/}' Cargo.toml
 
       - name: Build ${{ matrix.target }}
-        run: mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-cli
+        run: mise x -- cargo build --release --target ${{ matrix.target }} -p openshell-cli --features bundled-z3
 
       - name: sccache stats
         if: always()

deploy/docker/Dockerfile.cli-macos

@@ -31,6 +31,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     clang \
     cmake \
     curl \
+    libclang-dev \
     pkg-config \
     && rm -rf /var/lib/apt/lists/*
 

deploy/docker/Dockerfile.python-wheels

@@ -12,10 +12,11 @@ ENV PATH="/root/.cargo/bin:${PATH}"
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
+    cmake \
     curl \
     gcc \
     libc6-dev \
-    libz3-dev \
+    libclang-dev \
     pkg-config \
     libssl-dev \
     && rm -rf /var/lib/apt/lists/*
@@ -74,7 +75,7 @@ RUN --mount=type=cache,id=cargo-registry-python-wheels-${TARGETARCH},sharing=loc
     --mount=type=cache,id=cargo-git-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
     --mount=type=cache,id=sccache-python-wheels-${TARGETARCH},sharing=locked,target=/tmp/sccache \
-    . cross-build.sh && cargo_cross_build --release -p openshell-cli 2>/dev/null || true
+    . cross-build.sh && cargo_cross_build --release -p openshell-cli --features bundled-z3 2>/dev/null || true
 
 # Copy actual source code and Python packaging files.
 COPY crates/ crates/
@@ -108,7 +109,7 @@ RUN --mount=type=cache,id=cargo-registry-python-wheels-${TARGETARCH},sharing=loc
     if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \
       sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \
     fi && \
-    maturin build --release --target "${CARGO_BUILD_TARGET}" --out /wheels
+    maturin build --release --target "${CARGO_BUILD_TARGET}" --features bundled-z3 --out /wheels
 
 FROM scratch AS wheels
 COPY --from=builder /wheels/*.whl /

deploy/docker/Dockerfile.python-wheels-macos

@@ -25,6 +25,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     clang \
     cmake \
     curl \
+    libclang-dev \
     libssl-dev \
     pkg-config \
     && rm -rf /var/lib/apt/lists/*