ci: replace host nasm with one-time sandbox index refresh (mcpp#232)

mcpp 0.0.96 self-bootstraps nasm, but its release archive vendors an
index snapshot cut before xim-pkgindex#398 fixed the nasm descriptor,
and the bootstrap is offline-first — it would install the broken
vendored nasm.lua as an empty payload. A single 'xlings update'
against the sandbox home (~/.mcpp/registry) before the workspace run
lets the lazy bootstrap resolve the fixed descriptor. Drop the step
once a mcpp release vendors a post-#398 snapshot.

Author: Sunrisepeak

.github/workflows/validate.yml

@@ -213,14 +213,17 @@ jobs:
       # `xlings install nasm`), lazily, only when the plan has .asm units —
       # same self-bootstrap contract as the llvm toolchain. The sandbox copy
       # lands in ~/.mcpp/registry, so the cache carries it across runs.
-      # TEMPORARY belt-and-suspenders for compat.ffmpeg's NASM sources: the
-      # 0.0.95 lazy nasm self-bootstrap declares the build dead BEFORE the
-      # one-time bootstrap finishes (mcpp#232, 2x reproduced cold). PATH-first
-      # resolution makes this deterministic; drop once #232 is fixed.
-      - name: Install nasm (Linux)
+      # The refresh below is needed because release archives vendor an index
+      # snapshot and the bootstrap is offline-first: 0.0.96 shipped with a
+      # nasm.lua deployed engines can't resolve — it "installs" empty
+      # (mcpp#232; fixed in xim-pkgindex#398 after the release was cut).
+      # One `xlings update` against the sandbox home lets the bootstrap see
+      # the fixed descriptor. Drop once a mcpp release vendors a post-#398
+      # index snapshot.
+      - name: Refresh sandbox package index (nasm bootstrap, mcpp#232)
         if: runner.os == 'Linux'
         shell: bash
-        run: sudo apt-get update && sudo apt-get install -y nasm
+        run: XLINGS_HOME="$HOME/.mcpp/registry" "$MCPP_VENDORED_XLINGS" update
 
       - name: mcpp test --workspace
         shell: bash