fix(ci): add WASM asset verification before CLI build in SEA workflow

The SEA build was failing because CLI build requires Yoga Layout WASM,
but the workflow wasn't verifying WASM assets were actually restored
from cache before attempting CLI build.

Issue:
- WASM caches restore successfully (actions/cache/restore)
- Verification steps report "valid=true"
- But actual files might not be present due to cache corruption/issues
- CLI build fails: "ENOENT: no such file or directory, open yoga.wasm"

Fix:
- Add pre-flight check before CLI build step
- Verify yoga.wasm exists before proceeding
- Fail fast with clear error if WASM assets missing
- Directs user to run build-wasm.yml to prime cache

This provides better diagnostics and prevents wasted build time.

Author: jdalton

.github/workflows/build-sea.yml

@@ -368,6 +368,28 @@ jobs:
           key: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.sea-cache-key.outputs.hash }}
           restore-keys: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-
 
+      - name: Verify WASM assets before CLI build
+        if: steps.sea-cache.outputs.cache-hit != 'true' || inputs.force
+        shell: bash
+        run: |
+          echo "=== Checking WASM asset availability ==="
+          echo "Yoga Layout:"
+          ls -lh packages/yoga-layout/build/wasm/ 2>/dev/null || echo "  ❌ Directory not found"
+          echo ""
+          echo "AI Models:"
+          ls -lh packages/socketbin-cli-ai/dist/ 2>/dev/null || echo "  ❌ Directory not found"
+          echo ""
+          echo "ONNX Runtime:"
+          ls -lh packages/onnx-runtime-builder/dist/ 2>/dev/null || echo "  ❌ Directory not found"
+          echo ""
+
+          # Fail fast if critical Yoga Layout WASM is missing
+          if [ ! -f "packages/yoga-layout/build/wasm/yoga.wasm" ]; then
+            echo "::error::Yoga Layout WASM not found! Run build-wasm.yml workflow to prime cache."
+            echo "Cache status was: yoga=${{ steps.yoga-cache-valid.outputs.valid }}"
+            exit 1
+          fi
+
       - name: Build CLI (required for SEA)
         if: steps.sea-cache.outputs.cache-hit != 'true' || inputs.force
         run: pnpm --filter @socketsecurity/cli run build