- Replace actions/checkout (pulls from github.com) with scripts/ci_checkout.sh
fetched from this Gitea over raw/commit.
- Remove the macOS job (no runner).
- Disable sanitizers until the Docker runner has SYS_PTRACE; it was wedging
the only slot with AddressSanitizer:DEADLYSIGNAL.
- Add windows-cross: Nix UCRT mingw via TUNA, bootstrap_windows.sh, verify
dist/cst-agent-*-windows-x86_64.zip. Third-party git clones go through
gitclone.com.
