ci: substitute the specification per step, not per job

Measured 2026-08-28 across the eight repositories of this ecosystem while one
change spanned all of them: eight jobs in four of them called `mcpp build' at a
point where the manifest still named openkal BY VERSION, so a version under
review -- which by definition is not published -- failed them with E_NOT_FOUND.

The mechanism is not a missing substitution. run-conformance.sh substitutes the
manifest and RESTORES IT ON EXIT, correctly; every step after it is back to
naming a version. So an audit asking "does this job substitute?" passes the job
and misses the steps, which is how the first pass at this found three
repositories and not four.

These steps are green on main and can only be green there, because there the
published version is the one under test. It is not a check that fails, it is a
check that cannot run at the only time it would have something to say.

The substitution is also portable now: the opensbi and uefi portability jobs run
on macOS and Windows, where BSD sed requires an argument to -i that GNU sed
refuses.

Author: Sunrisepeak

.github/workflows/ci.yml

@@ -196,10 +196,17 @@ jobs:
           # a graph in which one package reaches a dependency by version and
           # another by path, so substituting only the root leaves the build
           # refusing for a second reason instead of the first.
-          sed -i 's|^openkal = .*$|openkal = { path = ".spec" }|' mcpp.toml
-          sed -i 's|^openkal = .*$|openkal = { path = "../../.spec" }|' examples/hello/mcpp.toml
-          grep -q 'path = ".spec"' mcpp.toml && grep -q 'path = "../../.spec"' examples/hello/mcpp.toml \
-            || { echo "::error::the specification was not substituted"; exit 1; }
+          # ⚠️ NOT `sed -i'. This step runs on macOS and on Windows too, and
+          # BSD sed requires an argument to -i that GNU sed refuses. A temporary
+          # file is the spelling that holds on all three.
+          subst() {   # subst <file> <relative-path-to-the-specification>
+            sed "s|^openkal = .*$|openkal = { path = \"$2\" }|" "$1" > "$1.next"
+            mv "$1.next" "$1"
+            grep -q "path = \"$2\"" "$1" \
+              || { echo "::error::$1 was not substituted"; exit 1; }
+          }
+          subst mcpp.toml .spec
+          subst examples/hello/mcpp.toml ../../.spec
       - name: Install the emulator
         run: |
           # Both homes: the shim on PATH dispatches against whichever home owns
@@ -497,9 +504,16 @@ jobs:
           # a graph in which one package reaches a dependency by version and
           # another by path, so substituting only the root leaves the build
           # refusing for a second reason instead of the first.
-          sed -i 's|^openkal = .*$|openkal = { path = ".spec" }|' mcpp.toml
-          grep -q 'path = ".spec"' mcpp.toml \
-            || { echo "::error::the specification was not substituted"; exit 1; }
+          # ⚠️ NOT `sed -i'. This step runs on macOS and on Windows too, and
+          # BSD sed requires an argument to -i that GNU sed refuses. A temporary
+          # file is the spelling that holds on all three.
+          subst() {   # subst <file> <relative-path-to-the-specification>
+            sed "s|^openkal = .*$|openkal = { path = \"$2\" }|" "$1" > "$1.next"
+            mv "$1.next" "$1"
+            grep -q "path = \"$2\"" "$1" \
+              || { echo "::error::$1 was not substituted"; exit 1; }
+          }
+          subst mcpp.toml .spec
       - name: The backend cross-builds
         run: |
           # ⚠️ TWICE, AND THE FIRST IS ALLOWED TO FAIL — every row of this