fix(ci): move Windows WASM cache check before build attempt

Move the Windows WASM cache requirement check to run immediately after
cache validation steps, before attempting to build WASM assets. This
prevents Windows builds from failing during AI model downloads due to
network issues.

Previous behavior:
- Cache validation steps run
- Setup Python and start building WASM assets
- Windows builds fail during AI model download from Hugging Face
- Windows cache check never triggered (too late in workflow)

New behavior:
- Cache validation steps run
- Windows cache check runs immediately if any cache invalid
- Build fails fast with clear error message before setup steps
- No wasted time on expensive Python/Emscripten setup

The check now correctly blocks Windows builds that don't have pre-cached
WASM assets from build-wasm.yml workflow.

Author: jdalton

.github/workflows/build-sea.yml

@@ -154,6 +154,13 @@ jobs:
             echo "✗ ONNX Runtime cache invalid or missing"
           fi
 
+      - name: Check WASM cache requirements (Windows)
+        if: matrix.os == 'windows' && (steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true')
+        run: |
+          echo "::error::WASM assets not cached for Windows build. Run build-wasm.yml workflow first to prime the cache."
+          echo "Windows builds require pre-cached WASM assets due to network reliability issues."
+          exit 1
+
       - name: Setup Python for WASM builds
         if: steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true'
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
@@ -239,13 +246,6 @@ jobs:
           key: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.sea-cache-key.outputs.hash }}
           restore-keys: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-
 
-      - name: Check WASM cache requirements (Windows)
-        if: matrix.os == 'windows' && (steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true')
-        run: |
-          echo "::error::WASM assets not cached for Windows build. Run build-wasm.yml workflow first to prime the cache."
-          echo "Windows builds require pre-cached WASM assets due to network reliability issues."
-          exit 1
-
       - name: Build CLI (required for SEA)
         if: steps.sea-cache.outputs.cache-hit != 'true' || inputs.force
         run: pnpm --filter @socketsecurity/cli run build