feat: add Checks system for YAML workflow execution

.cargo/config.toml

@@ -0,0 +1,7 @@
+[env]
+# Downloads the official prebuilt libduckdb for the build target instead of
+# compiling DuckDB's C++ amalgamation from source, which otherwise costs
+# 10+ minutes and several GB of disk on every clean build. Requires the
+# duckdb crate's "bundled" feature to stay off (see src-tauri/Cargo.toml) --
+# libduckdb-sys only reads this var on the non-bundled build path.
+DUCKDB_DOWNLOAD_LIB = "1"

.github/workflows/cli-binary.yml

@@ -46,6 +46,12 @@ jobs:
         run: cargo build --release --bin treq
 
       - name: Run CLI with filesystem writes denied
+        env:
+          # DUCKDB_DOWNLOAD_LIB (repo-wide via .cargo/config.toml) links duckdb
+          # dynamically; libduckdb-sys's rpath link-arg doesn't propagate from
+          # its build script into this binary, so point the loader at the
+          # prebuilt dylib libduckdb-sys copies alongside the other deps.
+          DYLD_LIBRARY_PATH: ${{ github.workspace }}/target/release/deps
         run: |
           sandbox-exec \
             -p '(version 1) (allow default) (deny file-write*)' \