Pin toolchain v0.5 (veristat + qemu)

Copy the v0.5 release's versions.env into build/toolchain.lock: bumps
TOOLCHAIN_VERSION 0.3 -> 0.5 and pins veristat + the static qemu (with
checksums), so `make veristat` resolves the vendored veristat and
`make veristat-matrix` / the CI workflow fetch the static qemu, all
checksum-verified against the release.

Verified the published v0.5 qemu-{x86_64,aarch64}.tar.gz and veristat
binaries match these pinned checksums.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: julian-goldstein

template/build/toolchain.lock

@@ -5,7 +5,7 @@
 # release `v<TOOLCHAIN_VERSION>` holding the whole set; consumers pin this one
 # number, and the cache is keyed by it (cache/yeet/toolchain/v<N>/<arch>/). CI
 # bumps it by 0.1 on every publish (which only happens when build/ changes).
-TOOLCHAIN_VERSION=0.3
+TOOLCHAIN_VERSION=0.5
 
 # Where a consumer fetches assets from: the version-tagged release. The fetch
 # appends `/v<TOOLCHAIN_VERSION>/<tool>-<arch>`.
@@ -27,7 +27,16 @@ CLANG_SHA256_aarch64=105fb2d324095127a127bcba56702a86229ed8892ce6429802d30585fa2
 BPFTOOL_VERSION=7.7.0
 BPFTOOL_SHA256_x86_64=74bd16335aa1c40714fb50287a42766c6faa4958f969cce32fef89485ce4934c
 BPFTOOL_SHA256_aarch64=2b3fc4dd5e4e40bd8d670c5f1fa9693b3f879a122c0f6a3eb806dfc6735da6b7
-LIBBPF_HEADERS_SHA256=bd0f88dbf44ec9bff33fba039bc824e48bdd5f35b7217e510fffe1623a7cb648
+LIBBPF_HEADERS_SHA256=3e49dd2a33938962c174db2cc33c928812d9fea5b9ba0f7c66d24577cfb1d697
+
+# veristat — BPF verifier statistics tool, used to check that built `*.bpf.o`
+# programs load and to track verifier complexity. Official static binary from
+# libbpf/veristat (a mirror of the kernel tree's tool), re-hosted on our
+# "toolchain" release like bpftool. CI records the per-arch binary checksums
+# (consumers verify the binary, not the upstream tarball).
+VERISTAT_VERSION=0.5.1
+VERISTAT_SHA256_x86_64=fa81d2da6b0d33f73c5469e5a97e7d0afaf4e216635f57ae15428402381b95c0
+VERISTAT_SHA256_aarch64=847aa761493055f23ecc758468e8d17869a4905ff6b5eedadb993c1e9f75d1bd
 
 # GNU make — the build driver. Built static from source (tiny, fast). Since
 # make can't fetch itself, `yeet build` bootstraps it into the cache at the
@@ -50,5 +59,19 @@ ESBUILD_VERSION=0.28.1
 ESBUILD_SHA256_x86_64=0c6588b092a2c291a72bab90659f3c9e0e25e0fe59c9ac12b4dae4d945e5548c
 ESBUILD_SHA256_aarch64=51e829ba36f36be6d9aea6e329ddc4f9350302339b16aaca96a3cb97f64a8ebb
 
+# qemu — NOT part of the build toolchain: a fully-static qemu-system for the
+# optional kernel-matrix test runner (boots lvh kernel images). Built per-arch
+# from source (see Dockerfile.qemu / build-qemu.sh), trimmed to the binary plus
+# the few firmware blobs its machine loads. Needs host KVM + root at runtime, so
+# it's fetched on demand by the harness, never resolved by `make`. LIBSLIRP is a
+# build-time dep (user-mode networking) compiled static since Alpine has no
+# -static package for it.
+QEMU_VERSION=9.1.2
+LIBSLIRP_VERSION=4.8.0
+# Per-arch checksum of the published qemu-<arch>.tar.gz (binary + minimal
+# share/qemu blobs). CI records these; the matrix runner verifies the tarball.
+QEMU_SHA256_x86_64=8e66d5d0aedaa712619667020d13813447ec05714914e9d4af173408b1e9fe93
+QEMU_SHA256_aarch64=0abe1c226030f94400851fe66fe3ccfd9f986c2e2fd8ec90d5a53eaa3c4992cf
+
 # Alpine base used for the musl-static clang build.
 ALPINE_TAG=alpine:3.21