[ci] stage BoringSSL for the site build

With liburing installed the site build got past linking and then failed
rendering:

    [kyo-net native-guard] library 'kyonet_boringssl' is a STUB in
    kyo-net.state: a stub must not ship in a native classifier jar.

Without a staged BoringSSL tree, build.sbt compiles the c-boringssl-stub
shim. kyo-net wires kyoNetNativeClassifierGuard into Compile/packageBin
(build.sbt), and the site render reaches kyo-net's packageBin through
kyo-http, so the guard runs and rejects the stub even though this
workflow publishes nothing.

Stages the vendored BoringSSL the way .github/actions/release-setup
already does. The previous commit's claim that a stub is enough for a
docs render was wrong: it holds for readme.yml, which runs doctest and
never packages kyo-net.

Author: fwbrasil

.github/workflows/deploy-site.yml

@@ -40,13 +40,23 @@ jobs:
         with:
           jvm: corretto:25
           apps: sbt
-      # liburing (build-time only): the site bundle reaches kyo-net through kyo-http, and linking it
-      # compiles kyo-net's io_uring FFI shim (kyo_uring.c), which statically links -luring. This
-      # workflow does not use .github/actions/setup, so install it here too, as readme.yml does.
-      # BoringSSL is not staged: build.sbt falls back to the c-boringssl-stub shim, which is all a
-      # docs render needs.
+      # The site reaches kyo-net through kyo-http, so rendering it compiles kyo-net's C shims. This
+      # workflow does not use .github/actions/setup, so the native build deps are installed here, as
+      # readme.yml does for the same reason.
+      #
+      # liburing (build-time only): the io_uring shim (kyo_uring.c) statically links -luring.
       - name: Install liburing (Linux)
         run: bash scripts/apt-install.sh liburing-dev
+      # BoringSSL has to be staged, not stubbed. Without the staged tree build.sbt compiles the
+      # c-boringssl-stub shim, and kyo-net's `Compile / packageBin` runs kyoNetNativeClassifierGuard
+      # (build.sbt), which fails on a stub. The site render needs kyo-net's packageBin, so it trips
+      # the guard even though it publishes nothing.
+      - name: Prepare BoringSSL
+        shell: bash
+        run: |
+          command -v cmake >/dev/null 2>&1 || bash scripts/apt-install.sh cmake
+          command -v go >/dev/null 2>&1 || bash scripts/apt-install.sh golang-go
+          bash kyo-net/build/boringssl/build-boringssl.sh linux-x86_64
       - name: Link the browser bundle (fullLinkJS)
         run: sbt 'kyo-website-bundleJS/Compile/fullLinkJS'
       - name: Render and assemble the site from the current repo