ci(shell-native): force xvfb GLX + mesa software-render for P0 probe

Linux P0 probe was failing with `GLXBadWindow` because:
- bare `xvfb-run` brings up Xvfb with default args (no `+extension GLX`);
  the X server then advertises no GLX FBConfigs, so winit's X11 backend
  fails when glutin tries to create a GL window.
- the runner has no GPU, so even with GLX enabled mesa would not pick a
  hardware visual; without a software fallback configured glutin cannot
  resolve `ContextApi::OpenGl`.

Fix:
- pass `xvfb-run -s "-screen 0 1280x1024x24 +extension GLX +render
  -noreset"` so Xvfb advertises a 24-bit GLX-capable visual.
- set `LIBGL_ALWAYS_SOFTWARE=1`, `GALLIUM_DRIVER=llvmpipe`, and
  `MESA_GL_VERSION_OVERRIDE=4.5` so mesa loads llvmpipe (CPU
  rasterizer) and reports a desktop-GL version high enough for skia.

These env vars propagate naturally from the workflow shell down through
xvfb-run → cargo → the spawned `cargo run --example p0_probe`
subprocess (probe runs each verification in a fresh process so winit's
EventLoop singleton guard doesn't trip).

.github/workflows/rust-check.yml

@@ -59,9 +59,29 @@ jobs:
       # tests. Linux: route through `xvfb-run` for a virtual display.
       # Windows: the test body early-returns with a "deferred" message
       # (spec §8.2 WINDOWS_GPU_DEFERRED_NO_RUNNER); macOS: runs natively.
+      #
+      # Xvfb arguments:
+      #   -screen 0 1280x1024x24 — 24-bit color so GLX visuals can match.
+      #   +extension GLX        — explicitly enable GLX (without this, a
+      #                           winit X11 window hits `GLXBadWindow` when
+      #                           the X server reports an empty FBConfig list).
+      #   +render               — RENDER extension (winit/skia path queries it).
+      #   -noreset              — keep the X server alive across the cargo
+      #                           subprocess fork (probe spawns
+      #                           `cargo run --example p0_probe` per test).
+      # Env:
+      #   LIBGL_ALWAYS_SOFTWARE=1 + GALLIUM_DRIVER=llvmpipe forces mesa to
+      #   software-render (xvfb has no GPU); without it create_context
+      #   negotiates an unusable hardware visual.
       - name: P0 probe gate (Linux)
         if: runner.os == 'Linux'
-        run: xvfb-run -a cargo test -p openpencil-shell-native --test p0_probe -- --ignored
+        env:
+          LIBGL_ALWAYS_SOFTWARE: '1'
+          GALLIUM_DRIVER: llvmpipe
+          MESA_GL_VERSION_OVERRIDE: '4.5'
+        run: |
+          xvfb-run -a -s "-screen 0 1280x1024x24 +extension GLX +render -noreset" \
+            cargo test -p openpencil-shell-native --test p0_probe -- --ignored
       - name: P0 probe gate (macOS / Windows)
         if: runner.os != 'Linux'
         run: cargo test -p openpencil-shell-native --test p0_probe -- --ignored