CI: build the graphics configuration, and run the test suite

[msollami]

Summary

Two CI jobs for two configurations that nothing currently builds or runs, plus one command that
does the same locally.

Issue #65 is the motivating case. The vendored stb_image in src/imageio.c collided with the copy
inside libraylib.a, and USE_GRAPHICS=1 on Linux failed to link with dozens of multiple definition of 'stbi_load'. It reached a user rather than CI because that configuration is built by
nobody:

• macOS ld64 tolerates duplicate symbols across archives where GNU ld makes it a hard error, so
  the graphics link always succeeded locally;
• the build job tries apt-get install libraylib-dev and is allowed to continue without it — and
  on these runner images it is never available (E: Unable to locate package libraylib-dev), so every
  run has built USE_GRAPHICS=0 and the placeholder renderer.

The second gap is the test suite. CI compiles the tree and runs two source-level gates; the 400+ test
binaries have never been run by anything but a person choosing to. A subset is indistinguishable from
the whole in a summary, and a pull request recently reported the suite as passing on the strength of
40 of 426 binaries.

Changes

build-graphics job — installs the X11/GL headers, builds raylib 5.5 from source (it is not
in the runner's package set, which is why the apt attempt kept failing), links the tree with
USE_GRAPHICS=1, and fails rather than degrading: a job that quietly builds the placeholder
renderer is what hid #65. It then asserts the regression directly — src/imageio.o must export no
stbi_* symbols (nm shows t, not T) — which catches this class even against a library other
than raylib. Verified against Sam's fix in main: 0 exported, 139 file-local.

tests job — runs tools/run_test_suite.sh, which builds every test target and runs every
binary in one pinned configuration, comparing the outcome against tests/known_failures.txt.

tools/run_test_suite.sh + make check-tests — the same thing locally, so the gate is
reproducible before pushing rather than only discoverable after. Three traps are handled explicitly,
each of which cost real time to diagnose:

• the subset — every *_tests binary runs; nobody chooses;
• the configuration — pinned and printed, because a tree left at USE_FLINT=OFF reports 36
  failures of which 32 are the missing library, and one target cannot even link there;
• the timeout — timeout is GNU coreutils and absent on macOS, where an unguarded call exits 127
  and a pass/fail loop reads that as a failing test. During development this produced a "0 passed,
  444 failed" run that looked like catastrophe and was a missing binary. gtimeout is used when
  present, and its absence is reported rather than silently turning every result red.

tests/known_failures.txt — the standing failures, each with a one-line reason. A listed failure
does not fail the run; an unlisted one does; a listed test that starts passing is named so its line
can be deleted. Without this the gate would be red on the day it lands, and a gate that is red on
arrival teaches people that red means nothing.

Not in this PR, because it is already in main: flint_bridge_tests is built only when
USE_FLINT=ON (it calls flint_cyclotomic_gcd, which lives inside #ifdef USE_FLINT, so with FLINT
off the target fails to link and takes make in tests/ with it). Mentioned because the tests
job depends on that being true.

Testing

• tools/run_test_suite.sh run against this branch (= main at 9ee372e): 437 passed, 7 failed,
  7 baselined, no unexpected failures. The baseline was seeded from that run, not from another
  branch — four entries are long-standing, and three are the NMinimize/FindMinimum tests added on
  2026-08-16/17, each failing deterministically across three runs, so they are convergence
  assertions the optimizers do not currently meet rather than flaky tests. Every line carries its
  reason; none is mine to fix, and they should be short-lived.
• This is also the gate proving its own worth before it lands: those three failures are on main
  right now and nothing would have reported them.
• nm src/imageio.o on this branch: no exported stbi_* symbols, 139 file-local.
• Workflow YAML parses; sh -n tools/run_test_suite.sh clean.
• make check-c99, check-packed-aware, check-image-packing, check-menu-ids unchanged and green.

Notes for review

• The tests job builds 400+ binaries and will be the slowest job in the workflow. If PR turnaround
  matters more than simplicity, it shards cleanly over a matrix on the first letter of the binary
  name — happy to do that instead.
• Marking tests and build-graphics as required status checks in branch protection is what
  turns them from advisory into a gate; that is a repository setting, not something this PR can do.