ci: install build-essential for HQC cgo job (lux-build has no C compiler)

Follow-up to 39c1da3. The diagnostic from that commit confirmed the
lux-build runner has NO C compiler on PATH at all (not cc, clang, or
gcc) — PATH was just the stock /usr/bin:/bin etc. with the Go toolchain.
So compiler *selection* alone cannot fix it; a compiler must be
installed.

Add an 'Ensure C toolchain (cgo)' step that installs build-essential via
sudo apt-get when no compiler is present (the same mechanism sibling lux
repos already use to provision lux-build, e.g. node + universe install
apt packages there). The step is a no-op when a compiler already exists.
The subsequent CC-selection logic from 39c1da3 is retained.

Still not a crypto/KAT regression: the HQC NIST KAT roundtrip passes
locally; this is purely the runner lacking a C toolchain for cgo.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/ci.yml

@@ -70,18 +70,29 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
+      - name: Ensure C toolchain (cgo)
+        # The lux-build self-hosted runner ships no C compiler at all
+        # (PATH has no cc / clang / gcc), so the cgo build aborted with
+        #   cgo: C compiler "gcc" not found
+        # before any HQC code ran. Install build-essential (gcc) the same
+        # way sibling lux repos provision this runner. Skip if a compiler
+        # is already present so the step is a no-op on images that have one.
+        run: |
+          if command -v cc >/dev/null 2>&1 || command -v gcc >/dev/null 2>&1 || command -v clang >/dev/null 2>&1; then
+            echo "C compiler already present; skipping install."
+          else
+            echo "No C compiler on PATH; installing build-essential."
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends build-essential
+          fi
       - name: HQC PQClean cgo build + test
         env:
           CGO_ENABLED: '1'
         run: |
-          # The lux-build self-hosted runner does not ship `gcc` (cgo's
-          # default CC on Linux), so the build fails with
-          #   cgo: C compiler "gcc" not found
-          # before any HQC code runs. Pick the first C compiler that is
-          # actually on PATH (cc/clang/gcc) and pin CC to it. The PQClean
-          # HQC reference sources are portable C99 and build identically
-          # under clang or gcc, so the NIST KAT roundtrip is unaffected by
-          # the compiler choice.
+          # Pin CC to the first compiler actually on PATH (cc/clang/gcc).
+          # The PQClean HQC reference sources are portable C99 and build
+          # identically under clang or gcc, so the NIST KAT roundtrip is
+          # unaffected by the compiler choice.
           for candidate in "$CC" cc clang gcc; do
             if [ -n "$candidate" ] && command -v "$candidate" >/dev/null 2>&1; then
               CC="$candidate"