libcxx: install headers hermetically from the build tree

[lucatume]

build-libcxx.sh sourced libc++ headers from the floating host $LLVM_PREFIX while generating __config_site from the vendored LLVM 21 source. When the host LLVM drifted ahead of the vendored version (a Homebrew LLVM 22 leaking into a non-pure nix develop), the v22 __configuration/hardening.h demanded _LIBCPP_ASSERTION_SEMANTIC_DEFAULT, a macro the v21 __config_site never emits. Every downstream C++ build broke with:

__configuration/hardening.h:187: error: _LIBCPP_ASSERTION_SEMANTIC_DEFAULT is not defined

__configuration/hardening.h does not exist in libc++ 21.1.8 (hardening is inline in __config); it was introduced in LLVM 22, which is also where the hard-error was added. The proof of the mix: the cached hardening.h was byte-identical to Homebrew LLVM 22.1.6 while __config_site came from the vendored 21.1.8 build.

Changes

• Install the complete header set from the CMake build tree ($BUILD_DIR/include/c++/v1), which already stages the vendored-source headers plus the build-generated __config_site, __assertion_handler, module.modulemap, and the libc++abi headers. The host $LLVM_PREFIX no longer contributes headers, so header/lib version mixing is structurally impossible.
• Add a post-install smoke compile (<vector>/<string>/<stdexcept>, wasm target) against the freshly installed headers. Any header/__config_site inconsistency now fails the package build loudly instead of surfacing downstream.
• Update the now-stale host-LLVM version-check message (it claimed headers come from the host LLVM).
• Bump build.toml revision 4 -> 5 (output bytes change; invalidates the poisoned cache).

Verification

scripts/dev-shell.sh bash scripts/build-programs.sh exits 0. The resolver rejects the stale rev4 archive (cache_key_sha mismatch) and source-builds; the smoke compile passes; the previously-failing C++ programs (c_01..c_11, cpp_throw_test, d_06, k_06, s_08) compile and link.

Note: CI force-rebuild must republish the rev5 archive so other machines/CI get the hermetic artifact.

[github-actions]

Phase B-1 matrix build status — pr-626-staging

ABI v15. 66 built, 0 failed, 66 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	5c346370
libcxx	wasm32	built	b051ccf4
libcxx	wasm64	built	f19113c3
libpng	wasm32	built	e5f51ced
libxml2	wasm32	built	87e6323f
libxml2	wasm64	built	97b30508
openssl	wasm32	built	e9614c8b
openssl	wasm64	built	717578b0
sqlite	wasm32	built	a08614c8
sqlite	wasm64	built	14d9edb0
zlib	wasm32	built	7e2b9609
zlib	wasm64	built	7a75b7d8
bc	wasm32	built	8a45f553
bzip2	wasm32	built	a5d89fb5
coreutils	wasm32	built	4a231aef
curl	wasm32	built	8252c298
dash	wasm32	built	924b67d7
diffutils	wasm32	built	74c35f33
dinit	wasm32	built	5a90db86
fbdoom	wasm32	built	37453f85
file	wasm32	built	778a4ee0
findutils	wasm32	built	3c5a81c2
gawk	wasm32	built	d268e97d
git	wasm32	built	af3ce0a5
grep	wasm32	built	741a3c72
gzip	wasm32	built	9031cdf8
kandelo-sdk	wasm32	built	0d9d9a70
kernel	wasm32	built	c027e8db
less	wasm32	built	fe2fa045
lsof	wasm32	built	6eaa0fd9
m4	wasm32	built	38f389b4
make	wasm32	built	8c731052
mariadb	wasm32	built	57ffa3b5
mariadb	wasm64	built	a5137a08
msmtpd	wasm32	built	e6d5dc44
nano	wasm32	built	255fd593
ncurses	wasm32	built	e40d688f
netcat	wasm32	built	5d7ae3cf
nginx	wasm32	built	9b65a662
php	wasm32	built	1242ab3e
posix-utils-lite	wasm32	built	46aad238
sed	wasm32	built	05fca5a1
spidermonkey	wasm32	built	8589e614
tar	wasm32	built	a770f018
tcl	wasm32	built	d636d10e
unzip	wasm32	built	8c4aa726
userspace	wasm32	built	83217cb6
vim	wasm32	built	781eea3a
wget	wasm32	built	18c71bb2
xz	wasm32	built	330122b5
zip	wasm32	built	8f0da22a
zstd	wasm32	built	8cc58c92
bash	wasm32	built	ff3c924c
mariadb-test	wasm32	built	a23ac5dd
mariadb-vfs	wasm32	built	41f20273
mariadb-vfs	wasm64	built	e159e9ec
nethack	wasm32	built	211b0fb6
node	wasm32	built	8e6f6313
spidermonkey-node	wasm32	built	85b92699
vim-browser-bundle	wasm32	built	1c218259
nethack-browser-bundle	wasm32	built	19a3a4f4
rootfs	wasm32	built	bd2a761a
shell	wasm32	built	f250d4c8
lamp	wasm32	built	ac8c8118
node-vfs	wasm32	built	30b7052b
wordpress	wasm32	built	3592df1d

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Hi @lucatume, thank you for this PR! Sorry I haven't looked yet. I'll try to get to it yet this week.

[brandonpayton]

After looking at this, I made the following changes in order to encourage stability across kernel and core software builds:

• Be more explicit about the LLVM version used to produce the builds
• Take the libcxx and libunwind sources from the version of LLVM we install through Nix
• Fail CI and dependent software builds if there is an LLVM version mismatch
• Expanded this to an audit of remaining homebrew refs in the project

[github-actions]

prepare-merge: test-gate passed against the synthetic PR merge and binaries-abi-v15. Missing entries were built or promoted from PR staging only when their merged-tree cache key matched; merge-gate=success posted on PR HEAD and squash auto-merge enabled.

[brandonpayton]

Thank you, @lucatume!