Restore a toolchain the container was built with but no longer has

Fair point that this belongs in core rather than in vaultwarden.sh. Measured
it: 144 ct scripts call a toolchain in their update path without ensuring it
first -- 87 node, 30 uv, 16 go, 9 composer, 2 rust. Patching them one at a
time is not a fix.

Every setup_* already records what it installed under /var/cache/app-versions,
so the container knows what it was built with. When the binary that record
promises is not callable, ensure_recorded_toolchains re-runs the setup that
put it there. It runs on the update path, right after ensure_profile_loaded so
a tool that is merely off PATH is not mistaken for a missing one.

Only acts when something is actually broken: the normal cost is one
`command -v` per recorded tool. Restricted to the toolchains a build needs and
that are installed outside apt -- rust, go, nodejs, uv, composer, yq, ruby.
Unknown records are ignored rather than guessed at.

Tested against all four cases: rust recorded and cargo gone reinstalls and
comes back callable, cargo present does nothing, nothing recorded does
nothing, an unrelated record is ignored.

The vaultwarden.sh change from earlier is reverted -- it would have run
setup_rust on every update instead of only when needed, and the core check
covers the other 143 scripts too.

Author: MickLesk

core/core.func

@@ -136,6 +136,39 @@ icons() {
   HOURGLASS="${TAB}⏳${TAB}"
 }
 
+# Re-provision a toolchain the container was built with but no longer has.
+#
+# Every setup_* records what it installed under /var/cache/app-versions. When the
+# binary that record promises is gone, a script that compiles on update dies at
+# exit 127 with its service already stopped. 144 ct scripts call a toolchain in
+# their update path without ensuring it first, so this belongs here.
+ensure_recorded_toolchains() {
+  local cache=/var/cache/app-versions
+  [[ -d "$cache" ]] || return 0
+
+  local rec tool bin fn
+  for rec in "$cache"/*_version.txt; do
+    [[ -r "$rec" ]] || continue
+    tool="$(basename "$rec")"
+    tool="${tool%_version.txt}"
+    case "$tool" in
+    rust) bin=cargo fn=setup_rust ;;
+    go) bin=go fn=setup_go ;;
+    nodejs) bin=node fn=setup_nodejs ;;
+    uv) bin=uv fn=setup_uv ;;
+    composer) bin=composer fn=setup_composer ;;
+    yq) bin=yq fn=setup_yq ;;
+    ruby) bin=ruby fn=setup_ruby ;;
+    *) continue ;;
+    esac
+    command -v "$bin" >/dev/null 2>&1 && continue
+    declare -f "$fn" >/dev/null 2>&1 || continue
+    msg_warn "${bin} is recorded for this container but missing - reinstalling"
+    "$fn" || msg_error "Could not restore ${bin}"
+  done
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # ensure_profile_loaded()
 #

ui/API.txt

@@ -82,6 +82,7 @@ echo_default
 edit_default_storage
 ensure_global_default_vars_file
 ensure_profile_loaded
+ensure_recorded_toolchains
 ensure_storage_selection_for_vars_file
 ensure_tput
 ensure_whiptail

ui/menu.func

@@ -1104,6 +1104,7 @@ start() {
     VERBOSE="no"
     set_std_mode
     ensure_profile_loaded
+    ensure_recorded_toolchains
     get_lxc_ip
     # Move legacy containers onto the helper-based /usr/bin/update the next time
     # they update. No-op once migrated; preserves the container's original source.
@@ -1131,6 +1132,7 @@ start() {
     VERBOSE="no"
     set_std_mode
     ensure_profile_loaded
+    ensure_recorded_toolchains
     get_lxc_ip
     # Move legacy containers onto the helper-based /usr/bin/update the next time
     # they update. No-op once migrated; preserves the container's original source.
@@ -1177,6 +1179,7 @@ start() {
       ;;
     esac
     ensure_profile_loaded
+    ensure_recorded_toolchains
     get_lxc_ip
     # Move legacy containers onto the helper-based /usr/bin/update the next time
     # they update. No-op once migrated; preserves the container's original source.