fix(ci): install jq in the container so the Trope IR test actually runs (#32)

`CI / required` is the last red check on `main`. After #31 fixed the
version
assert, the job got two steps further and now fails at **Validate
repository
contracts** with exit code 2 and one line of output:

```
jq is required
```

## Root cause

`tests/check-examples.sh:15`:

```bash
command -v jq >/dev/null || { echo "jq is required"; exit 2; }
```

The pinned `idris2-pack` image does not ship `jq`. So the **Trope IR
conformance
test — the one asserting every example lowers to valid Trope IR — has
never
actually executed in CI.** It bailed before testing anything.

That makes this more than a build fix: it turns a step that always died
early
into one that genuinely exercises the language's core guarantee.

## Fix

Same class of problem as the missing `xz` in #28, so the step now
handles both:
collect what is absent, install in a single `apt-get` pass, print both
versions
so the log records what ran. A no-op on images that already have them.

## Verified locally against `origin/main` (d29f89e)

```
bash -n over tests/ scripts/ ............... all parse
tests/check-examples.sh .................... exit 0  → "examples: all lower to valid Trope IR"
tests/aspect_tests.sh ...................... exit 0  → PASS=3 FAIL=0 WARN=0
scripts/check-root-shape.sh ................ exit 0  → 45 entries, 46 permitted
tests/workflows/validate_workflows_test.sh . exit 0  → Workflow validation PASSED
```

Note `check-examples.sh` skips the verdict round-trip when no sibling
`tropecheck` binary is built — that part still needs `trope-checker`,
and is
reported as a `note`, not a pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/ci.yml

@@ -27,17 +27,24 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # The pinned idris2-pack image ships no xz binary, so setup-zig's
-      # .tar.xz download fails with "tar (child): xz: Cannot exec".
-      - name: Install xz (needed to unpack the Zig tarball)
+      # The pinned idris2-pack image is minimal. Two things are missing:
+      #   xz — setup-zig's .tar.xz download dies with "tar: xz: Cannot exec"
+      #   jq — tests/check-examples.sh exits 2 with "jq is required", so the
+      #        Trope IR conformance test never actually ran in CI
+      - name: Install container prerequisites (xz, jq)
         shell: bash
         run: |
           set -euo pipefail
-          if ! command -v xz >/dev/null 2>&1; then
+          missing=()
+          command -v xz >/dev/null 2>&1 || missing+=(xz-utils)
+          command -v jq >/dev/null 2>&1 || missing+=(jq)
+          if [ "${#missing[@]}" -gt 0 ]; then
+            echo "installing: ${missing[*]}"
             apt-get update -qq
-            apt-get install -y -qq --no-install-recommends xz-utils
+            apt-get install -y -qq --no-install-recommends "${missing[@]}"
           fi
           xz --version | head -1
+          jq --version
 
       - name: Set up Zig
         uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1