[julian-goldstein]

Summary

Use the yeet CLI's toolchain. build/toolchain.mk now tries two sources in order:

1. With yeet on PATH, every tool runs as yeet toolchain exec <tool> from the toolchain yeet toolchain default points at. One install shared with the CLI, no second ~200 MB copy under ~/.cache. If nothing is installed, the toolchain target runs yeet toolchain install <pinned> --default (the lock's version; latest without a lock). If a different default already exists it prints a warning instead of switching it.
2. Otherwise, or with make YEET=, the existing lock-pinned cache fetch. CI and yeet-less hosts are unchanged.

Toolchain paths (libbpf -I, veristat, qemu) are resolved lazily and memoized, because make expands variables at parse time while the install happens in a target. Everything that needs a path runs after | toolchain; make clean / make postgen never trigger a lookup or install.

Collateral: a tool may be a multi-word command, so existence checks probe $(firstword …), postgen runs git rather than testing for an executable file, and gen-vmlinux.sh takes the bpftool command quoted and word-splits it. kernel-matrix.sh prefers the qemu bundled with the yeet toolchain before downloading one.

Cargo-style output. New build/ui.mk:

   Toolchain yeet v0.10.1 (/home/me/.local/share/yeet/toolchain/linux/x86_64/v0.10.1)
  Generating src/bpf/include/vmlinux.h
sh build/gen-vmlinux.sh "/usr/bin/yeet toolchain exec bpftool" src/bpf/include/vmlinux.h
   Compiling cpusched.bpf.c
/usr/bin/yeet toolchain exec clang -g -O2 -Wall -target bpf …
     Linking bin/probe.bpf.o
    Bundling src/main.jsx
    Finished build in 0.67s

Bold green verbs on stderr (stdout stays clean for piping), color only when stderr is a tty with TERM != dumb and NO_COLOR unset, commands echoed under their status line, make QUIET=1 for status lines only. Compiler diagnostics pass through untouched; missing tools print a red error: line. esbuild's summary and bpftool's "loaded as base" note are silenced; gen-vmlinux.sh deletes the partial header on failure.

Upstream note: toolchain.mk and fetch-toolchain.sh are embed glue vendored from yeet-src/toolchain. The changes are mirrored into toolchain/embed/ here, but need a matching PR in yeet-src/toolchain before the next make sync-toolchain, which overwrites them from the tag.

Test plan

• Fresh scripts/new scaffold builds through yeet toolchain exec with zero warnings; make YEET= builds from the cache.
• Fresh-machine simulation (toolchain dir moved aside): make clean and make postgen install nothing; a single make installs v0.10.1 as default and builds with the correct include path in the same invocation.
• Pin mismatch (lock edited to v0.10.0) prints the warning; make -n has no side effects.
• make clangd points at yeet's libbpf headers; make -n veristat / veristat-matrix resolve a real binary path.
• Output: escape codes on a pty, plain when piped, QUIET=1, stdout-only capture is empty, deliberate compile error and bogus CLANG= surface, make -j4 from clean.
• make veristat-matrix (boots VMs; not run).