ci: fix test_subagent strcasestr crash; llvm-mingw Windows zip

clang under strict C11 left strcasestr undeclared (returns int → pointer
truncation → SIGSEGV). Parse Content-Length portably; keep -Werror on
make check. Drop Nix for windows-cross (root /nix fails) and use pinned
llvm-mingw UCRT instead; Alpine musl gets linux-headers for audit.h.

.gitea/workflows/ci.yml

@@ -37,7 +37,11 @@ jobs:
       - name: Build (warnings are errors)
         run: make CC=${{ matrix.cc }} CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" -j"$(nproc)"
       - name: Unit tests
-        run: make CC=${{ matrix.cc }} check
+        run: |
+          # Same -Werror as the build step so undeclared libc helpers cannot
+          # silently return int and truncate pointers (see test_subagent).
+          make CC=${{ matrix.cc }} \
+            CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" check
       - name: CMake build + ctest
         run: |
           cmake -B build -DCMAKE_C_COMPILER=${{ matrix.cc }} -DCST_BUILD_TUI=ON
@@ -69,7 +73,10 @@ jobs:
             -o /tmp/ci_checkout.sh
           bash /tmp/ci_checkout.sh
       - name: Install build dependencies
-        run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
+        run: |
+          # linux-headers provides linux/audit.h for the seccomp probe path
+          apk add --no-cache build-base pkgconf curl-dev ncurses-dev \
+            linux-headers git nodejs bash python3
       - name: Build + unit tests
         run: |
           make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
@@ -97,28 +104,8 @@ jobs:
           $SUDO apt-get install -y --no-install-recommends \
             ca-certificates curl git cmake ninja-build make pkg-config \
             python3 zip unzip perl xz-utils
-      - name: Install Nix (TUNA)
-        run: |
-          if ! command -v nix-shell >/dev/null; then
-            curl -L https://mirrors.tuna.tsinghua.edu.cn/nix/latest/install | sh -s -- --no-daemon
-          fi
-          mkdir -p "$HOME/.config/nix"
-          printf '%s\n' \
-            'substituters = https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store https://cache.nixos.org/' \
-            'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
-            > "$HOME/.config/nix/nix.conf"
-          # shellcheck source=/dev/null
-          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix --version
-      - name: Proxy GitHub for third_party clones
-        run: |
-          # curl/busybox-w32/ncurses sources; skip if the proxy is down
-          git config --global url."https://gitclone.com/github.com/".insteadOf "https://github.com/"
       - name: Cross-build Windows zip
-        run: |
-          # shellcheck source=/dev/null
-          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix-shell shell-win.nix --run 'scripts/bootstrap_windows.sh .'
+        run: bash scripts/ci_windows_cross.sh
       - name: Verify zip
         run: |
           ls -lah dist/windows-x86_64/