ci: substitute the specification per step, not per job

Measured 2026-08-28 across the eight repositories of this ecosystem while one
change spanned all of them: eight jobs in four of them called `mcpp build' at a
point where the manifest still named openkal BY VERSION, so a version under
review -- which by definition is not published -- failed them with E_NOT_FOUND.

The mechanism is not a missing substitution. run-conformance.sh substitutes the
manifest and RESTORES IT ON EXIT, correctly; every step after it is back to
naming a version. So an audit asking "does this job substitute?" passes the job
and misses the steps, which is how the first pass at this found three
repositories and not four.

These steps are green on main and can only be green there, because there the
published version is the one under test. It is not a check that fails, it is a
check that cannot run at the only time it would have something to say.

The substitution is also portable now: the opensbi and uefi portability jobs run
on macOS and Windows, where BSD sed requires an argument to -i that GNU sed
refuses.

Author: Sunrisepeak

.github/workflows/ci.yml

@@ -182,6 +182,39 @@ jobs:
         run: |
           bash .spec/tools/run-conformance.sh openkal-macos . full,optional
 
+      # ⚠️⚠️ CLONING THE SPECIFICATION IS NOT THE SAME AS BUILDING AGAINST IT.
+      #
+      # `.spec` is cloned at the top of this job and consumed by the script
+      # above, which substitutes this manifest itself and RESTORES IT ON EXIT
+      # --- correctly, since a script that rewrote a checked-in file and walked
+      # away would leave the tree holding a path. But every step BELOW calls
+      # `mcpp build` directly, and by then the manifest names `openkal` by
+      # version again, so they resolved the PUBLISHED specification:
+      #
+      #     E_NOT_FOUND: package 'compat.openkal@0.9.0' not found in the synced
+      #     index ... the index is current, so this name is either wrong or not
+      #     published yet
+      #
+      # ⭐⭐ THE UNIT IS THE STEP, NOT THE JOB, AND NOT THE REPOSITORY. Measured
+      # 2026-08-28 across the eight repositories of this ecosystem: eight jobs
+      # in four of them had this shape. An audit that asked "does this job
+      # substitute?" passed this one, because it does --- and then gives it
+      # back. These steps are green on `main` and can only be green there,
+      # because there the published version IS the one under test.
+      - name: Point at the specification's working tree
+        run: |
+          set -euo pipefail
+          # ⚠️ NOT `sed -i'. This step runs on macOS and on Windows too, and
+          # BSD sed requires an argument to -i that GNU sed refuses. A temporary
+          # file is the spelling that holds on all three.
+          subst() {   # subst <file> <relative-path-to-the-specification>
+            sed "s|^openkal = .*$|openkal = { path = \"$2\" }|" "$1" > "$1.next"
+            mv "$1.next" "$1"
+            grep -q "path = \"$2\"" "$1" \
+              || { echo "::error::$1 was not substituted"; exit 1; }
+          }
+          subst mcpp.toml .spec
+
       # The other architecture, as far as this system allows it to be reached.
       #
       # The system-call numbers agree between the two --- measured, in the