ci: verify snapshot kaitai

Run the snapshot Kaitai verifier in its own required xsm job. This gives schema, fixture, checksum, and cross-record validation a distinct CI result without coupling it to the libghostty-vt test suite.

.github/workflows/test.yml

@@ -111,6 +111,7 @@ jobs:
       - test-sentry-linux
       - test-i18n
       - test-fuzz-libghostty
+      - test-kaitai
       - test-lib-vt
       - test-lib-vt-pkgconfig
       - test-macos
@@ -1319,6 +1320,31 @@ jobs:
       - name: Test
         run: nix develop -c zig build test-lib-vt
 
+  test-kaitai:
+    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
+    needs: skip
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
+        with:
+          path: /nix
+
+      # Install Nix so the verifier uses the pinned compiler and runtimes.
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: Verify Snapshot Kaitai Schema
+        run: nix develop -c src/terminal/snapshot/verify-kaitai.py
+
   test-gtk:
     strategy:
       fail-fast: false