Use native candidate actions and harden frontend resource loading

scripts/build.sh

@@ -55,6 +55,15 @@ fetch_commit https://git.oeo.one/justme/libmonet.git "$work/libmonet" "$monet_co
 [ -z "${FETCH_ONLY:-}" ] || { echo ">> sources are in place"; exit 0; }
 
 echo ">> overlaying m3ui"
+echo ">> applying icon cache hardening"
+cache_patch="$root/patches/fcitx5-icon-cache.patch"
+if git -C "$srcdir" apply --check "$cache_patch"; then
+    git -C "$srcdir" apply "$cache_patch"
+elif git -C "$srcdir" apply --reverse --check "$cache_patch"; then
+    echo ">> icon cache hardening already applied"
+else
+    die "icon cache patch does not match Fcitx5 $version; refusing a partial build"
+fi
 rm -rf "$srcdir/src/ui/m3ui"
 cp -r "$root/src" "$srcdir/src/ui/m3ui"
 if ! grep -q 'add_subdirectory(m3ui)' "$srcdir/src/ui/CMakeLists.txt"; then