viewer/curl: clean stale CI build dir + guard against system libcurl shadowing

Self-hosted runners reuse the workspace Docker volume, so a stale build/ dir
could leave jfjoch_viewer linking a system libcurl instead of the vendored
FetchContent static one (curl configured but never compiled; viewer linked the
OS curl). Add a "Clean previous build" step (rm -rf build) to the two Linux
viewer jobs (build-viewer-tgz, build-rpm), and assert libcurl_static exists
after FetchContent_MakeAvailable(curl) so any future shadowing fails loudly
instead of silently linking the OS curl with the wrong TLS/Kerberos backend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build_and_test.yml

@@ -124,6 +124,10 @@ jobs:
             use_cuda: 'OFF'
     steps:
       - uses: actions/checkout@v4
+      - name: Clean previous build
+        shell: bash
+        run: rm -rf build   # self-hosted runners reuse the workspace volume; a stale build dir
+                            # can leave the viewer linking a system libcurl instead of the vendored one
       - name: Configure viewer build
         shell: bash
         run: |
@@ -219,6 +223,10 @@ jobs:
             upload_url: https://gitea.psi.ch/api/packages/mx/debian/pool/noble/nocuda/upload
     steps:
       - uses: actions/checkout@v4
+      - name: Clean previous build
+        shell: bash
+        run: rm -rf build   # self-hosted runners reuse the workspace volume; a stale build dir
+                            # can leave the viewer linking a system libcurl instead of the vendored one
       - name: Setup build (cmake)
         shell: bash
         run: |

CMakeLists.txt

@@ -296,6 +296,15 @@ IF (JFJOCH_VIEWER_BUILD OR JFJOCH_VIEWER_ONLY)
             GIT_TAG curl-8_11_1
             EXCLUDE_FROM_ALL)
     FetchContent_MakeAvailable(curl)
+    # The viewer must link the vendored static libcurl, never a system one. If FetchContent is
+    # ever short-circuited (find_package / a dependency provider resolving CURL to the OS libcurl,
+    # or a stale runner build dir), the libcurl_static target is absent -- fail loudly instead of
+    # silently linking the system curl with the wrong TLS/Kerberos backend.
+    IF (NOT TARGET libcurl_static)
+        MESSAGE(FATAL_ERROR
+                "libcurl was not built from FetchContent (libcurl_static target missing) -- a "
+                "system libcurl is shadowing the vendored one; wipe the build dir and reconfigure.")
+    ENDIF()
 ENDIF()
 
 IF (JFJOCH_VIEWER_ONLY)