ci: compile the unit tests before running them

[foxnne]

What changes

Tests (Windows) failed about one run in thirty (4 of the last 140 jobs) with test runner failed to respond for 1m… on whichever tiny std-only test was unlucky: fizzy-glass-look-tests, backend-titlebar-tests, fizzy-profile-causes-tests, fizzy-text-doc-state-tests, fizzy-profile-spans-tests, fizzy-settings-plugins-zon-tests. CI now compiles every unit test (zig build check) in a step of its own before zig build test runs them, so no compiler is alive while a test runs.

The cause is in Zig 0.16's std, not in fizzy. processSpawnWindows (std/Io/Threaded.zig) creates each child's pipe ends inheritable and calls CreateProcess with handle inheritance on, with no PROC_THREAD_ATTRIBUTE_HANDLE_LIST and no lock around it. So a child inherits every inheritable handle the build runner holds at that moment, including the pipe ends it is making for its other children. A compiler spawned while a test's pipes exist keeps a copy of that test's stdout write end. After the last test, the runner sends exit and waits for stdout EOF under its 60 s response timeout (std/Build/Step/Run.zig, waitZigTest/requestNextTest). The test has passed and exited, but EOF comes only when the compiler exits, so the step fails with "failed to respond" and reports no test as failed. Every failing run had a test compile that took ≥1 min (fizzy-crash-tests, fizzy-singleton-unix-tests, fizzy-plugin-store-tests). After check, zig build test finds every compile cached and spawns only test binaries, which live for milliseconds.

The transport tests were a red herring. fizzy-native-transport-tests passed (21/21) in every failing run. In the PR #460 failure it ran a minute after the hung tests had started. Its error.Unexpected NTSTATUS=0xc000020d (CONNECTION_RESET) trace comes from the cancel test: its holder closed the accepted socket with the request unread, Windows answers that with a reset, and Zig 0.16's netReadWindows maps every status it doesn't list (this one included, which should be error.ConnectionResetByPeer) to error.Unexpected, dumping a stack trace on stderr. The holder now reads the request first, so the close is a clean FIN and the trace is gone.

How it was found (throwaway workflow on ci/windows-flake-diag, since deleted):

• 40 test-only zig build test loops on 4 Windows runners: 0 hangs. 96 loops recompiling every test binary each time (from PowerShell, then again exactly as CI runs it, through Git Bash and ci-retry.sh's tee): 0 hangs. Those recompiles take ~4 s each and never produce the minute-long compilers.
• A standalone repro with no fizzy code: 8 empty tests, each run beside a 75 s ping. On windows-latest, instant-2-tests failed with test runner failed to respond for 1m5.202ms. Without the sleepers it passed, and on ubuntu-latest it passed both ways (posix pipes are O_CLOEXEC).
• Defender real-time protection is off on the runners, so scanning is ruled out.

Tried and dropped: --test-timeout (it raises the response timeout too, but only hides the wait), -j1 (slow), and retries (CONTRIBUTING: fix the cause).

SDK impact

• None

Verified

• macOS: zig build test -Dtest-filter=cancel passes with the transport change.
• Windows: run 38968162178 plus 5 reruns of Tests (Windows), all green: 563/568 passed (5 skipped) each time. Compile tests did the compiling, and in Run tests every compile was cached (the step takes ~12 s), so no compiler ran beside a test. No NTSTATUS/failed command lines in any of the six logs. At the old ~3% rate, six green runs alone prove little; the evidence is the repro plus that invariant.
• Linux: Tests (Linux) and the rest of CI green.
• Web: not affected.

Follow-ups

None. The cause is in Zig 0.16's std; this is fizzy's workaround, and the pitfall in docs/PITFALLS.md keeps the two steps apart.

🤖 Generated with Claude Code

[foxnne]

Reviewed. zig build check exists (build/app.zig:557, "Compile fizzy unit tests without running them"), so the new CI step compiles exactly what test needs, and the run step then spawns only test binaries. The NativeTransport test reading the request before holding fixes the reset-as-Unexpected noise at its cause, and the pitfall is written where the next person will look. All checks pass. Looks good to merge.

🤖 Generated with Claude Code