[matrixarkai]

cargo check / build / test — the gating job — has been failing on main since at least
2026-10-28, and it fails on every pull request, including ones whose diff cannot possibly affect it.

error: failed to run custom build command for `raft-proto v0.7.0`
  thread 'main' panicked at prost-build-0.11.9/src/lib.rs:1457:10:
  Could not find `protoc` installation and this build crate cannot proceed without
  this knowledge.

Confirmed on main's own head commit (27fd023, run 40886502716, nightly 2026-10-29), so this is
not a branch problem — the same job, the same panic, on main.

Why it was absent and still passed for months

Neither job installed it: the dependency step was clang libclang-dev cmake, and protoc came from
the runner image, which no longer provides it. protoc is not optional —
raft-proto's build script runs prost-build, which shells
out to it and panics without it.

What hid it is the cache. actions/cache restores target, so the debug build-script output
came back from the cache and cargo check never re-ran it. The release build below had nothing
cached and had to. The job therefore failed only on the release profile, which reads like a
release-only problem rather than a missing package.

That also means the fast check job — which passes on push today, and is the only job a push to
main runs — is passing on cache luck. It would fail the moment the cache went cold. Both jobs
are fixed here for that reason, not just the one that is currently red.

The package is identified by provenance, not by guess

On a machine where the build succeeds:

$ which protoc        -> /usr/bin/protoc   (libprotoc 3.12.4)
$ dpkg -S /usr/bin/protoc
protobuf-compiler: /usr/bin/protoc

So protobuf-compiler is the package that owns the binary the build script could not find.

Scope

One line per job plus the comment explaining it. No Rust code, no workflow logic, no triggers, no
job graph: check, build-and-test and sdk-rust are unchanged apart from the apt line in the
first two. Verified the file still parses and still declares all three jobs.

This PR's own run is the test of the fix — it exercises the same release build that is failing on
main.

I found this because it blocked merging an unrelated measurement PR, and the brief I am working to
says to merge only once this check is SUCCESS. It cannot be SUCCESS for anybody until this lands.