feat(flatpak): ship lldb and the Khronos validation layers

Programs that -r and the test runner start run inside the Flatpak's
sandbox, and the Sdk it runs on has gdb but neither lldb nor the Khronos
validation layer: in the sandbox of beta 5.0.0, a vkCreateInstance that
asks for VK_LAYER_KHRONOS_validation returns VK_ERROR_LAYER_NOT_PRESENT.
flatpak run clears VK_LAYER_PATH and VK_ADD_LAYER_PATH, so the layer the
host has cannot stand in.

lldb becomes a project of the llvm module and brings lldb-server,
lldb-dap and lldb-mcp. Its Python, libedit, curses, libxml2 and lzma
support are set ON instead of being left to detection, so a dependency
that goes missing fails the configure step rather than shipping an lldb
without it. The Sdk has neither SWIG nor libedit, so both become modules
before llvm, SWIG as build-only.

The layer is Vulkan-ValidationLayers vulkan-sdk-1.4.357.0, the Vulkan
SDK release of the Sdk's loader (libvulkan.so.1.4.357), built from
Vulkan-Headers, Vulkan-Utility-Libraries, SPIRV-Headers and SPIRV-Tools
at the revisions that release's scripts/known_good.json names. Those
four are built into /app at those revisions and removed afterwards. All
five come after the LLVM and WASI modules, so that bumping them reuses
the cached LLVM and WASI builds. UPDATE_DEPS is turned off: it defaults
to ON, which has update_deps.py clone the dependencies, and of all the
modules only crafter-build's build-args share the network.

packaging/flatpak/net.catcrafts.CrafterBuild.yaml

@@ -5,9 +5,14 @@
 # Platform: a build tool needs glibc's headers and crt objects, gcc's
 # libgcc_s, cmake, ninja, make, git and python at run time. Everything
 # compiler-shaped is ours and lives under /app: clang, lld, libclang, libc++,
-# compiler-rt (native and wasm32) and the WASI sysroot, all built from one
-# LLVM source tree so the modules crafter-build builds and the compiler that
-# consumes them can never drift apart.
+# compiler-rt (native and wasm32), lldb and the WASI sysroot, all built from
+# one LLVM source tree so the modules crafter-build builds and the compiler
+# that consumes them can never drift apart.
+#
+# Programs that `-r` and the test runner start run in this sandbox, so the
+# tools to debug them live here too: lldb (above), the Sdk's gdb, valgrind
+# and strace, and the Khronos Vulkan validation layers, GPU-assisted
+# validation included, which neither the Sdk nor its GL extensions carry.
 app-id: net.catcrafts.CrafterBuild
 runtime: org.freedesktop.Sdk
 runtime-version: '26.08'
@@ -25,13 +30,38 @@ finish-args:
   - --socket=fallback-x11
   - --socket=pulseaudio
   - --device=all
-  # gdb and friends from the Sdk
+  # lldb, and gdb and friends from the Sdk
   - --allow=devel
   - --env=PATH=/app/bin:/usr/bin
 cleanup:
   - /share/man
   - /share/doc
 modules:
+  - name: swig
+    # Generates lldb's Python bindings while the llvm module builds; nothing
+    # of it ships.
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://downloads.sourceforge.net/project/swig/swig/swig-4.4.1/swig-4.4.1.tar.gz
+        sha256: 40162a706c56f7592d08fd52ef5511cb7ac191f3593cf07306a0a554c6281fcf
+
+  - name: libedit
+    # Line editing, history and completion at lldb's prompt. The Sdk has the
+    # ncurses it needs but not libedit itself; liblldb links the shared
+    # library, so that ships and the rest goes.
+    config-opts:
+      - --disable-static
+    cleanup:
+      - /include
+      - /lib/pkgconfig
+      - /lib/*.la
+    sources:
+      - type: archive
+        url: https://thrysoee.dk/editline/libedit-20260512-3.1.tar.gz
+        sha256: 432d5e7ea8b0116dd39f2eca7bc11d0eed77faa6b77ea526ace89907c23ea4a0
+
   - name: llvm
     buildsystem: cmake-ninja
     builddir: true
@@ -50,8 +80,20 @@ modules:
     config-opts:
       - -DCMAKE_BUILD_TYPE=Release
       - -DLLVM_ENABLE_ASSERTIONS=OFF
-      - -DLLVM_ENABLE_PROJECTS=clang;lld
+      - -DLLVM_ENABLE_PROJECTS=clang;lld;lldb
       - -DLLVM_ENABLE_RUNTIMES=compiler-rt;libcxx;libcxxabi;libunwind
+      # lldb with Python scripting (its bindings generated by the swig module
+      # above, against the Sdk's Python), libedit (the module above), curses,
+      # libxml2 and lzma, each set ON rather than left to the default of "if
+      # found", so a dependency gone missing fails the configure step instead
+      # of shipping an lldb without it. lldb-server, lldb-dap and lldb-mcp
+      # come with it.
+      - -DLLDB_ENABLE_PYTHON=ON
+      - -DLLDB_ENABLE_LIBEDIT=ON
+      - -DLLDB_ENABLE_CURSES=ON
+      - -DLLDB_ENABLE_LIBXML2=ON
+      - -DLLDB_ENABLE_LZMA=ON
+      - -DLLDB_ENABLE_LUA=OFF
       - -DLLVM_TARGETS_TO_BUILD=X86;AArch64;WebAssembly
       # Classic layout: libc++ in lib/ and include/c++/v1, not under a
       # per-target subdirectory, the same shape as a distro install.
@@ -82,6 +124,7 @@ modules:
       - /include/clang
       - /include/clang-tidy
       - /include/lld
+      - /include/lldb
       - /lib/cmake
       - /lib/*.a
       - /share/opt-viewer
@@ -219,6 +262,99 @@ modules:
         url: https://github.com/llvm/llvm-project/releases/download/llvmorg-22.1.8/llvm-project-22.1.8.src.tar.xz
         sha256: 922f1817a0df7b1489272d18134ee0087a8b068828f87ac63b9861b1a9965888
 
+  # The Khronos validation layers and the four modules they are built from,
+  # after llvm, so that bumping them reuses the cached LLVM build. All five
+  # are pinned to the Vulkan SDK release of the Sdk's own Vulkan loader and
+  # headers (1.4.357), at the dependency revisions that release's
+  # scripts/known_good.json names. When the runtime moves to a newer loader,
+  # move the layers to the SDK release of that loader and take the other
+  # four revisions from its known_good.json again. The four are built into
+  # /app at those revisions rather than taken from the Sdk, whose versions
+  # follow the runtime, and none of them ships.
+  - name: vulkan-headers
+    buildsystem: cmake-ninja
+    builddir: true
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-Headers/archive/refs/tags/v1.4.357.tar.gz
+        sha256: 7dc0dbcf1d49dd3d7da3761c251c6097dfbaac475321a4a8a99269d3d5abecdc
+
+  - name: vulkan-utility-libraries
+    buildsystem: cmake-ninja
+    builddir: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      # CMake searches its install prefix after /usr, where the Sdk has
+      # Vulkan headers of its own.
+      - -DCMAKE_PREFIX_PATH=/app
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/archive/refs/tags/v1.4.357.tar.gz
+        sha256: e8688013cdc67dad26f15dcece91fa6b80ad595d551fceb56397fc4795efd00a
+
+  - name: spirv-headers
+    buildsystem: cmake-ninja
+    builddir: true
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/SPIRV-Headers/archive/29981f65241605e08b0ede4cfeb999fe3b723c6a.tar.gz
+        sha256: 232899f1ad4104fb5bc377b94596c7621575eee62ad9a9e8f929b63a7dd8a7ad
+
+  - name: spirv-tools
+    # The optimizer GPU-assisted validation instruments shaders with, linked
+    # into the layer statically.
+    buildsystem: cmake-ninja
+    builddir: true
+    build-options:
+      no-debuginfo: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      # The installed SPIRV-Headers: its include/ holds the grammar files
+      # SPIRV-Tools generates its tables from, as the source tree does.
+      - -DSPIRV-Headers_SOURCE_DIR=/app
+      - -DSPIRV_SKIP_EXECUTABLES=ON
+      - -DSPIRV_WERROR=OFF
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/SPIRV-Tools/archive/b707790a898e44038547df54580022fc1cf89c3d.tar.gz
+        sha256: 05d8af89737bde57571c48dbd36714c9f520a69623e14de72c3be6b600e277d6
+
+  - name: vulkan-validation-layers
+    # VK_LAYER_KHRONOS_validation. The loader finds its manifest under
+    # /app/share/vulkan/explicit_layer.d through XDG_DATA_DIRS, and the
+    # manifest names the library without a path, which the sandbox's loader
+    # finds in /app/lib. GPU-AV is a setting of this layer, not a layer of
+    # its own (VK_KHRONOS_VALIDATION_GPUAV_ENABLE=1, or the layer settings).
+    buildsystem: cmake-ninja
+    builddir: true
+    build-options:
+      no-debuginfo: true
+      strip: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      - -DCMAKE_PREFIX_PATH=/app
+      # ON by default: it clones every dependency with update_deps.py, which
+      # the build sandbox has no network for, instead of using the four
+      # modules above.
+      - -DUPDATE_DEPS=OFF
+      - -DBUILD_TESTS=OFF
+      - -DBUILD_WERROR=OFF
+    post-install:
+      - test -f /app/share/vulkan/explicit_layer.d/VkLayer_khronos_validation.json
+      - test -f /app/lib/libVkLayer_khronos_validation.so
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-ValidationLayers/archive/refs/tags/vulkan-sdk-1.4.357.0.tar.gz
+        sha256: 73180b11992a3554e97ebc18e6bf2b45ff9790ded9d87fc526c7bab865d1303f
+
   - name: crafter-build
     buildsystem: simple
     build-options: