ci(github-actions): install the SurrealDB CLI — Groups E/J spawn it as a child process

The first CI run did exactly its job and failed on itself. All sixteen images
built; the unit-test job died with `spawn surreal ENOENT`.

services/record-surrealdb-resolver's test/domains.test.ts is not a pure unit
test — it starts a real `surreal start … memory` as a child process and talks
to it. On a developer machine that binary is already on PATH, so the suite
passes locally and only fails on a clean runner.

That is the same laptop-vs-clean-machine asymmetry that hid the missing
tsconfig COPY for twelve days, and it is worth naming: I verified all five test
commands locally before committing the workflow, and that verification was
worthless for this failure mode for precisely the reason CI exists.

Installs the CLI and asserts it is on PATH before the groups run, so a future
install-script change fails on a legible line rather than inside vitest.

Files changed:
- .github/workflows/ci.yml

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZJvZWco3z7SR2dEhFqEjA

Author: mpstaton

.github/workflows/ci.yml

@@ -92,6 +92,19 @@ jobs:
       # the lockfile have drifted, which a split-across-commits change can do.
       - run: pnpm install --frozen-lockfile
 
+      # Groups E/J are not pure unit tests: test/domains.test.ts spawns a real
+      # `surreal start … memory` as a child process. On a developer machine that
+      # binary is already on PATH, so the suite passes locally and fails here
+      # with `spawn surreal ENOENT` — the same laptop-vs-clean-machine asymmetry
+      # that hid the tsconfig bug for twelve days. Install it explicitly.
+      - name: Install SurrealDB CLI (Groups E/J spawn it)
+        run: |
+          curl -sSf https://install.surrealdb.com | sh -s -- --yes
+          echo "$HOME/.surrealdb" >> "$GITHUB_PATH"
+
+      - name: Verify surreal is on PATH
+        run: surreal version
+
       # Mirrors scripts/test-all.sh minus Group I. The e2e group drives a real
       # backend chain over a live WebSocket (e2e/harness.mjs wants NATS and
       # SurrealDB), so it needs service containers before it can run here.