test: cover build-time guards from PR #820 (empty-targets, musl-host, regex fixture)

[anandgupta42]

Found during v0.7.1 release review (Tech Lead persona).

PR #820 added several build-time defenses in packages/opencode/script/build.ts:

1. Empty-targets guard (build.ts:196-206) — --target-index=99 or a --targets= flag that matches nothing now exits 1 instead of producing zero artifacts silently.
2. musl-host --single guard (build.ts:208-226) — refuses to build the glibc target on an Alpine/musl host where the resulting binary can't run.
3. _requiredExports regex extraction — captures upstream NAPI-RS loader format. v0.7.1 added a JSON.parse + shape-check on the captured literal, but no test exercises the regex against a real upstream loader fixture.

None of these defenses have a test today. v0.7.1's adversarial test covers runtime invariants (hermetic startup, .node count via strings), not the build-time decision points above.

Acceptance

A new test file packages/opencode/test/install/build-guards.test.ts (or similar) that:

• Asserts bun run script/build.ts --target-index=999 exits non-zero with a message that names the cause.
• Asserts bun run script/build.ts --single on a host that looks like musl (mockable via env var or fixture) exits non-zero with a message naming apk add gcompat.
• Loads a copy of upstream NAPI-RS's loader format (committed as a fixture under test/install/fixtures/) and asserts the regex extracts a valid string array. Updates whenever altimate-core upgrades.
• Asserts a tampered fixture (_requiredExports = ["x"]; phoneHome(); const _foo = [) is rejected by the JSON.parse + shape-check added in v0.7.1.

Why this isn't in v0.7.1

Each test requires standing up a build-script invocation harness that doesn't exist today. The scope-disciplined v0.7.1 release added the adversarial runtime tests but deferred build-time test infra to a focused PR.

[maheshsv]

can i work on this