ci: 在 Linux 上构建,在真机上跑 —— 而那两个 job 什么都不装

原先 CI 证明的是「同一份源码不知道自己在哪台机器上」(裸机 + 本机,四行输出
diff 相等)。现在加证「构建也不必在那台机器上」:一台 Linux 宿主产出 PE 和
Mach-O,两个 job 把它们下载下来在真的 Windows 和真的 macOS 上跑。

⭐⭐ 那两个 job 故意没有任何工具链步骤 —— 不装 mcpp、不装编译器、不装 C 运行时。
程序自带 C 库、C++ 运行时和展开器,剩下的只有它被构建给的那个操作系统。如果哪
天有人因为「程序需要」而往里加一步安装,那一步就是发现,不是修复。

⚠️ 交叉构建产出一个格式正确的文件,只证明编译器被告知了正确的目标。它不证明程
序能跑 —— 而这套生态在这两个平台上找到的每一处差异(加载器 bootstrap 的
thread-local、展开器找自己的表、人格例程)都是**链接成功、运行时失败**。

判据是 unwound: true —— 析构函数在展开中跑到了,链接骗不出这一行。

两处断言写在运行之前,因为它们的修法不同:
· 格式(PE32+ / Mach-O arm64)在构建 job 里断言 —— 失败意味着目标选错了;
· ad-hoc 签名在 macOS job 里断言 —— arm64 macOS 拒绝未签名镜像,失败意味着
  链接器没签,而不是程序崩了。
⚠️ 产物上传会丢执行位,所以 chmod 在前。

── 本机已验(⚠️ wine 不等于 Windows,所以才要上面那个 job)──────

  x86_64-linux-gnu    ELF   跑通
  x86_64-windows-gnu  PE    跑通(wine)
  riscv64-none-elf    ELF   跑通(qemu + OpenSBI)
  aarch64-macos       Mach-O 产出,LC_CODE_SIGNATURE 在

Author: speak-agent

.github/workflows/ci.yml

@@ -197,3 +197,100 @@ jobs:
           # The four lines are the same four lines.
           diff <(grep -E '^(sorted|caught|unwound|import std over openkal):' out.log) \
                <(grep -E '^(sorted|caught|unwound|import std over openkal):' host.log)
+
+      # ⭐⭐ AND THE SAME SOURCE FOR TWO MACHINES THIS ONE IS NOT.
+      #
+      # The two steps above prove the source does not know which machine it is
+      # for. These prove the BUILD does not need to be on it: one Linux host
+      # produces a PE and a Mach-O, and the jobs below run them on the real
+      # thing with nothing installed.
+      #
+      # ⚠️ THE ARTEFACT IS THE ARGUMENT, WHICH IS WHY THOSE JOBS INSTALL NOTHING.
+      # Not mcpp, not a compiler, not a C runtime — the program carries its C
+      # library, its C++ runtime and its unwinder, and what remains is the
+      # operating system it was built for. A run that needed a redistributable
+      # installed first would be demonstrating something weaker.
+      - name: The same source, built here for Windows and for macOS
+        if: matrix.toolchain == 'llvm@22.1.8'
+        run: |
+          set -euo pipefail
+          cd examples/same-source
+          mkdir -p "$RUNNER_TEMP/cross"
+          for t in x86_64-windows-gnu aarch64-macos; do
+            rm -rf target
+            mcpp build --target "$t"
+            a=$(find target -type f \( -name 'openkal-same-source' -o -name '*.exe' \) | head -1)
+            [ -n "$a" ] || { echo "::error::$t produced no artefact"; exit 1; }
+            echo "$t → $(file -b "$a")"
+            cp "$a" "$RUNNER_TEMP/cross/"
+          done
+          # ⚠️ The format is asserted here rather than left to the run jobs. A
+          # run that fails tells you the program did not work; this tells you
+          # what was produced, and the two failures need different fixes.
+          file "$RUNNER_TEMP/cross/openkal-same-source.exe" | grep -q 'PE32+ executable'
+          file "$RUNNER_TEMP/cross/openkal-same-source"     | grep -q 'Mach-O 64-bit arm64'
+
+      - uses: actions/upload-artifact@v4
+        if: matrix.toolchain == 'llvm@22.1.8'
+        with:
+          name: cross-artifacts
+          path: ${{ runner.temp }}/cross/
+          if-no-files-found: error
+
+  # ---------------------------------------------------------------------------
+  # ⭐⭐ THE ACCEPTANCE CRITERION FOR PORTABILITY OF THE ARTEFACT.
+  #
+  # A cross build that produces a well-formed file proves the compiler was told
+  # the right target. It does not prove the program runs, and every difference
+  # this ecosystem has had to find on these two platforms — the loader-bootstrapped
+  # thread-local, the unwinder's search for its own tables, the personality
+  # routine — links successfully and fails at run time.
+  #
+  # ⚠️ These jobs deliberately have NO toolchain steps. If one is ever added
+  # because "the program needs it", that is the finding, not the fix.
+  run-on-windows:
+    name: the artefact built on Linux runs on Windows
+    needs: runtime
+    runs-on: windows-2022
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: cross-artifacts, path: art }
+      - name: It runs, and it unwinds
+        run: |
+          set -euo pipefail
+          ./art/openkal-same-source.exe 2>&1 | tee out.log
+          grep -q 'sorted: 2 4 7'   out.log
+          grep -q 'caught: 42'      out.log
+          # ⭐ The line a link cannot fake: a destructor ran during the unwind,
+          # so libunwind found `.eh_frame` by reading the image rather than by
+          # asking the operating system to enumerate modules.
+          grep -q 'unwound: true'   out.log
+          grep -q 'import std over openkal: ok' out.log
+
+  run-on-macos:
+    name: the artefact built on Linux runs on macOS
+    needs: runtime
+    runs-on: macos-14
+    timeout-minutes: 10
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: cross-artifacts, path: art }
+      - name: It runs, and it unwinds
+        run: |
+          set -euo pipefail
+          # ⚠️ The executable bit does not survive an artefact upload.
+          chmod +x art/openkal-same-source
+          # ⚠️ AND THE SIGNATURE DOES. arm64 macOS refuses an unsigned image, so
+          # this is asserted before the run: a failure here is "the linker did
+          # not ad-hoc sign it", which is a different repair from "the program
+          # crashed".
+          codesign -dv art/openkal-same-source 2>&1 | grep -q 'adhoc\|Signature'
+          ./art/openkal-same-source 2>&1 | tee out.log
+          grep -q 'sorted: 2 4 7'   out.log
+          grep -q 'caught: 42'      out.log
+          grep -q 'unwound: true'   out.log
+          grep -q 'import std over openkal: ok' out.log