Gate the GPU renderer behind the runtime feature

.github/workflows/ci.yml

@@ -92,12 +92,32 @@ jobs:
         run: |
           cargo clippy -p tauri-runtime-blitz \
             --no-default-features --features agent-control -- -D warnings
-      - name: No window stack in the graph
+      # Renderers as well as window stacks. This checked for `tauri`, GTK and
+      # WebKit and passed while the headless build linked wgpu, two versions of
+      # vello, naga and wgpu-hal: `anyrender_vello` was a hard dependency, so
+      # the only consumers who could reach it were the ones that could never
+      # use it. `mod runtime` is the sole user and was already behind the
+      # `runtime` feature, so nothing but the manifest had to change.
+      #
+      # `ps-anyrender-vello-cpu` is deliberately not banned. It arrives through
+      # `blitz-script` behind `debug-control`, which is what serves the
+      # `screenshot` endpoint, and rasterising is what that endpoint is for.
+      # Whether a pure inspection host should offer it at all is a separate
+      # question; this check is about not linking a GPU stack by accident.
+      #
+      # The target is pinned rather than inherited, so the answer does not
+      # depend on which runner this lands on.
+      - name: No window stack or GPU renderer in the graph
         run: |
           found=$(cargo tree -p tauri-runtime-blitz --edges normal \
+            --target x86_64-unknown-linux-gnu \
             --no-default-features --features agent-control \
-            | grep -ciE 'tauri v|gtk|glib|webkit|soup' || true)
+            | grep -ciE 'tauri v|gtk|glib|webkit|soup|wgpu|naga|ps-vello v|anyrender-vello v' || true)
           if [ "$found" != "0" ]; then
-            echo "the headless build pulled in $found window-stack crates" >&2
+            echo "the headless build pulled in $found window-stack or renderer crates" >&2
+            cargo tree -p tauri-runtime-blitz --edges normal \
+              --target x86_64-unknown-linux-gnu \
+              --no-default-features --features agent-control \
+              | grep -iE 'tauri v|gtk|glib|webkit|soup|wgpu|naga|ps-vello v|anyrender-vello v' >&2 || true
             exit 1
           fi

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/tauri-runtime-blitz"]
 
 [workspace.package]
-version = "0.3.4"
+version = "0.3.5"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 publish = true

crates/tauri-runtime-blitz/Cargo.toml

@@ -9,7 +9,7 @@ homepage.workspace = true
 repository.workspace = true
 
 [dependencies]
-anyrender_vello = { package = "ps-anyrender-vello", version = "^0.14.0" }
+anyrender_vello = { package = "ps-anyrender-vello", version = "^0.14.0", optional = true }
 anyrender_vello_hybrid = { package = "ps-anyrender-vello-hybrid", version = "^0.10.0", optional = true }
 style = { version = "0.20.0", package = "stylo" }
 # Plain defaults, which as of ps-blitz 0.4.4 no longer include `system-fonts`.
@@ -65,7 +65,22 @@ default = ["agent-control", "runtime"]
 # Off, a headless consumer gets the inspection and activation surface with no
 # Tauri in its graph, which on Linux is the difference between a build and GTK
 # development headers for a binary that never opens a window.
-runtime = ["dep:tauri", "dep:tauri-runtime", "dep:tauri-utils"]
+#
+# `anyrender_vello` belongs here too, and did not. `mod runtime` is the only
+# thing that names `VelloWindowRenderer`, and that module is already behind this
+# feature, so the renderer was reachable by exactly the consumers that could
+# never use it. A headless build linked wgpu, two versions of vello, naga and
+# wgpu-hal to serve a socket that reads a semantic tree.
+#
+# Same shape as `system-fonts` sitting in `blitz-dom`'s defaults: the intent was
+# written down in this comment, and nothing enforced it. The graph check below
+# now looks for renderers as well as window stacks.
+runtime = [
+    "dep:tauri",
+    "dep:tauri-runtime",
+    "dep:tauri-utils",
+    "dep:anyrender_vello",
+]
 agent-control = ["blitz-shell/debug-control", "dep:blitz-control-protocol", "dep:blitz-dom", "dep:blitz-traits", "dep:endpoint-libs", "dep:keyboard-types", "dep:serde", "dep:serde_json", "dep:tokio"]
 debug-control = ["blitz-script/debug-control", "blitz-shell/debug-control"]
 diagnostics = [