build: a vendor bump rebuilds libghostty-vt, everywhere it is consumed

Three stale-build landmines, all found by shipping v0.1.7 -- the first
release where new code (GhosttySearch) actually needed the vendor bump
of 2026-09-01:

- $(VT_LIB) had no prerequisites, so an existing .a *was* the build:
  the macOS builder compiled pane.c against zig-out headers from before
  the bump. The vendor manifest is now the prerequisite; a re-vendor
  rewrites it, so a bump rebuilds the lib and its installed headers.

- web/demo had the same guard and also never passed -Dversion-string:
  upstream's build.zig ran git describe in our repo, and on the tag
  checkout web/publish builds from, a slosh tag is a fatal version
  mismatch. Both fixed; both had hidden behind a stale build/vt.

- The builder's zig-pkg (excluded from the sync, and left half-empty by
  a once-interrupted push) is an input, not a cache: it is now synced
  separately and additively, so a bump's new packages arrive and a
  partial local tree cannot maim the builder's copy.

3 files changed, 30 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index c4aa82a..a149202 100644
--- a/Makefile
+++ b/Makefile
@@ -125,7 +125,13 @@ build/version.h: FORCE | build
 build:
 	@mkdir -p build
 
-$(VT_LIB):
+# The manifest is the prerequisite: contrib's re-vendor rewrites it every
+# time, so a vendor bump rebuilds the library and its installed headers.
+# Without it, an existing .a *was* the build -- and a machine whose zig-out
+# predated a bump compiled new code against old headers (the v0.1.7 macOS
+# leg failed exactly there: pane.c wanted GhosttySearch, the builder's
+# stale include/ had never heard of it).
+$(VT_LIB): $(VT).vendor.json
 	@$(MAKE) vendor
 
 # -Demit-xcframework=false: we only need libghostty-vt.a. In lib-vt mode the
diff --git a/contrib/macos-remote-build b/contrib/macos-remote-build
index 55583ba..9442f93 100755
--- a/contrib/macos-remote-build
+++ b/contrib/macos-remote-build
@@ -152,6 +152,18 @@ else
         --exclude '/tests/fuzz/' \
         --exclude '.DS_Store' \
         "$root/" "$BUILDER:$DIR/" || fail "rsync failed"
+    # zig-pkg is excluded above (and protected from --delete) because it is
+    # 350M of vendored zig packages -- but it is an *input* to `make all`, not
+    # a cache: a vendor bump adds packages, and a builder missing one cannot
+    # build (v0.1.7 died on a translate_c that a once-interrupted sync had
+    # left as empty directories). So it is synced separately, additively:
+    # rsync sends only what changed, which after the first push is nothing,
+    # and no --delete means a partial local tree cannot maim the builder's.
+    if [ -d "$root/vendor/libghostty-vt/zig-pkg" ]; then
+        rsync -a "$root/vendor/libghostty-vt/zig-pkg/" \
+            "$BUILDER:$DIR/vendor/libghostty-vt/zig-pkg/" \
+            || fail "rsync of zig-pkg failed"
+    fi
     # web/ and tests/fuzz/ are excluded above but *tracked*, and .git went
     # over whole -- so the builder's stale copies of them read as local edits,
     # and `git describe --dirty` stamps a clean release tree -dirty (which is
diff --git a/web/demo/Makefile b/web/demo/Makefile
index 03d51b4..ac188b3 100644
--- a/web/demo/Makefile
+++ b/web/demo/Makefile
@@ -78,10 +78,20 @@ vendor/.stamp: fetch-vendor
 # for SIMD, does not compile for rv64gc -- it emits RVV intrinsics for a vector
 # extension this target does not have. The scalar paths are the same code
 # without the hand-vectorised fast path, which for a demo VM is free.
-$(VT_LIB):
+# -Dversion-string, as at the top level: the vendored tree has no .git, so
+# upstream's version detection runs `git describe` in *our* repository -- and
+# on a tag checkout (exactly where web/publish builds a release site) it
+# finds a slosh tag, which upstream treats as a fatal mismatch. The manifest
+# prerequisite is the top level's too: a vendor bump must rebuild this lib,
+# or the demo compiles new code against the old headers. Both stayed hidden
+# behind a stale build/vt until v0.1.7 cleared it.
+VT_VERSION := $(shell sed -n 's/^[[:space:]]*\.version = "\([^"]*\)".*/\1/p' $(VT)/build.zig.zon | head -1)
+
+$(VT_LIB): $(VT).vendor.json
 	$(call say,[ZIG],libghostty-vt $(TARGET))
 	$(Q)cd $(VT) && PATH="$(dir $(ZIG)):$$PATH" zig build \
 	    -Demit-lib-vt -Dsimd=false -Doptimize=ReleaseFast -Dtarget=$(TARGET) \
+	    -Dversion-string=$(VT_VERSION) \
 	    --prefix $(abspath $(VT_OUT)) --cache-dir $(abspath build/vt-cache)
 
 # FORCE, as at the top level: rewritten only when the value actually changes,