fix(ci): unblock the now-honest static-analysis gate and the Idris2 CI job

.envrc

@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
 # Activate development environment
 # Install direnv: https://direnv.net/
 
@@ -20,8 +20,9 @@
 # Project environment variables
 export PROJECT_NAME="Haec"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
+# Project secrets (DATABASE_URL, API_KEY, ...) belong in .env, which is
+# gitignored and sourced below. Do not add them here: .envrc is committed,
+# and assignment-shaped comments trip secret scanners.
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists

.github/workflows/ci.yml

@@ -26,6 +26,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The pinned idris2-pack image ships no xz binary, so setup-zig's
+      # .tar.xz download fails with "tar (child): xz: Cannot exec".
+      - name: Install xz (needed to unpack the Zig tarball)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v xz >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq --no-install-recommends xz-utils
+          fi
+          xz --version | head -1
+
       - name: Set up Zig
         uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
         with: