fix(ci): Prevent lucihttp compilation failure in SDK build

The actual issue was NOT missing ninja-build (it was already installed),
but lucihttp dependency trying to compile without Lua headers.

Error was:
  fatal error: lua.h: No such file or directory
  ninja: build stopped: subcommand failed

Root Cause:
- lucihttp is a LuCI dependency that requires compilation
- OpenWrt SDK environment doesn't have Lua development headers
- Our SecuBox packages are PKGARCH:=all (pure scripts, no compilation)
- They don't actually need lucihttp to be compiled

Fix Applied:
1. Add logic to download pre-built lucihttp/cgi-io/lua packages
2. Explicitly disable lucihttp and cgi-io compilation in .config
3. Enable use of pre-built packages from feeds
4. Let SDK use pre-built dependencies instead of compiling

Changes:
- Download step now actually fetches pre-built dependencies
- Configuration step disables problematic packages:
  # CONFIG_PACKAGE_lucihttp is not set
  # CONFIG_PACKAGE_cgi-io is not set
- Enables feeds for pre-built packages

This allows our script-only packages to build successfully
without triggering compilation of C-based dependencies.

Testing: Will be validated by next GitHub Actions run

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.github/workflows/build-openwrt-packages.yml

@@ -472,13 +472,36 @@ jobs:
             curl -sL "${REPO_BASE}/packages/Packages" > packages_base.txt || true
           fi
 
-          # Note: Actual package download logic would go here
+          # Download critical LuCI dependencies that fail to compile in SDK
-          # For now, we just note that dependencies exist
+          echo "Downloading lucihttp and related packages..."
+          DEPS=("lucihttp" "cgi-io" "lua")
+
+          for dep in "${DEPS[@]}"; do
+            if [[ "$PKG_EXT" == "apk" ]]; then
+              # For APK, try to extract package names from index
+              echo "Looking for $dep packages..."
+              curl -sL "${REPO_BASE}/luci/${dep}*.${PKG_EXT}" -o "${dep}.${PKG_EXT}" 2>/dev/null || true
+              curl -sL "${REPO_BASE}/packages/${dep}*.${PKG_EXT}" -o "${dep}.${PKG_EXT}" 2>/dev/null || true
+            else
+              # For IPK, download from packages feed
+              curl -sL "${REPO_BASE}/luci/${dep}_*.${PKG_EXT}" -o "${dep}.${PKG_EXT}" 2>/dev/null || true
+              curl -sL "${REPO_BASE}/packages/${dep}*.${PKG_EXT}" -o "${dep}.${PKG_EXT}" 2>/dev/null || true
+            fi
+          done
+
+          # Install downloaded packages into SDK
+          for pkg in *.${PKG_EXT}; do
+            if [[ -f "$pkg" && -s "$pkg" ]]; then
+              echo "  ✓ Downloaded: $pkg"
+              # Copy to SDK packages directory for installation
+              cp "$pkg" ../../packages/ 2>/dev/null || true
+            fi
+          done
 
           cd ../..
 
           echo ""
-          echo "✅ Download step completed"
+          echo "✅ Dependency download completed"
           echo "Note: Our SecuBox packages are PKGARCH:=all (scripts only)"
           echo "They will be built regardless of dependency availability"
 
@@ -502,6 +525,15 @@ jobs:
           echo "CONFIG_AUTOREMOVE=y" >> .config
           echo "CONFIG_BUILDBOT=y" >> .config
 
+          # Disable problematic packages that fail to compile in SDK
+          # Our SecuBox packages are PKGARCH:=all (scripts) so they don't need these
+          echo "# CONFIG_PACKAGE_lucihttp is not set" >> .config
+          echo "# CONFIG_PACKAGE_cgi-io is not set" >> .config
+
+          # Enable use of pre-built packages from feeds
+          echo "CONFIG_FEED_packages=y" >> .config
+          echo "CONFIG_FEED_luci=y" >> .config
+
           make defconfig
 
       - name: Build packages