build: finish cross-platform release tooling

scripts/ci_tcc.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# CI helper: build the pinned TinyCC used for the verification job.
+# Distro tcc packages are too old (no <stdatomic.h>), so this builds the same
+# mob snapshot nixpkgs ships. Installs to $CST_TCC_PREFIX (default ~/.local/tcc)
+# and, under Actions, puts its bin/ on $GITHUB_PATH.
+set -euo pipefail
+
+COMMIT="${CST_TCC_COMMIT:-f6385c05308f715bdd2c06336801193a21d69b50}"
+PREFIX="${CST_TCC_PREFIX:-$HOME/.local/tcc}"
+WORK="${TMPDIR:-/tmp}/tcc-build"
+
+if [[ -x "$PREFIX/bin/tcc" ]]; then
+  echo "==> tcc already at $PREFIX"
+else
+  rm -rf "$WORK"
+  mkdir -p "$WORK"
+  TGZ="$WORK/tinycc.tar.gz"
+  # repo.or.cz is upstream but often unreachable from CN runners; the GitHub
+  # mirror carries the same commits.
+  urls=(
+    "https://ghfast.top/https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://ghproxy.net/https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://repo.or.cz/tinycc.git/snapshot/${COMMIT}.tar.gz"
+  )
+  ok=0
+  for u in "${urls[@]}"; do
+    echo "  try $u"
+    if curl -fsSL --retry 2 --connect-timeout 15 --max-time 300 -o "$TGZ" "$u" &&
+        tar -tzf "$TGZ" 2>/dev/null | sed -n 1p | grep -q "${COMMIT:0:7}"; then
+      ok=1
+      break
+    fi
+  done
+  [[ $ok -eq 1 ]] || { echo "failed to download tinycc $COMMIT" >&2; exit 1; }
+  tar -C "$WORK" -xzf "$TGZ"
+  src=$(find "$WORK" -mindepth 1 -maxdepth 1 -type d -name 'tinycc*' | head -1)
+  cd "$src"
+  ./configure --prefix="$PREFIX" --cc="${BUILD_CC:-cc}"
+  make -j"$(nproc)"
+  make install
+fi
+
+"$PREFIX/bin/tcc" -v
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$PREFIX/bin" >>"$GITHUB_PATH"
+fi