build(guix): add x86_64-pc-windows-msvc cross-compilation

Adds a fourth reproducibility target: the MSVC ABI Windows build that
CKB's CI currently produces via a Visual Studio runner.  Cross-compiled
from Linux using clang-cl + lld-link and an xwin-extracted Microsoft SDK
(user-provided at depends/SDKs/msvc-vs17-sdk10.0.22621, same pattern as
the Apple SDK for darwin).

What changes:

* manifest.scm — a (string-suffix? "-pc-windows-msvc" target) cond
  branch that pulls in clang-toolchain-20, lld-20, rust-src-pkg, and
  zip.  rust-src-pkg was inlined in the darwin branch; it's now a
  top-level definition shared between darwin and windows-msvc because
  both need the Rust source to build library/std from scratch via x.py.

* guix-build — x86_64-pc-windows-msvc in SUPPORTED_HOSTS; MSVC SDK
  detection block modelled on OSX_SDK; --share the SDK into the guix
  container and pass MSVC_SDK into the environment.

* libexec/build.sh — new HOST case with clang-cl as REAL_CC and an
  lld-link wrapper (cross-lld-link) that injects /LIBPATH: for the
  xwin SDK lib directories so neither x.py nor rustc has to know the
  paths.  x.py builds library/std from source using the same pattern
  as darwin (config.toml, checksum regen, host rustlib copy).  The
  host rustlib copy now chmod -R u+w so subsequent `rm -rf distsrc`
  can clean up the /gnu/store-read-only files (latent bug: also
  affected darwin on reruns).  RUSTFLAGS carries /Brepro and
  /DEBUG:NONE for a deterministic PE.

* libexec/rust-linker.sh — dedicated *-pc-windows-msvc case that
  forwards rustc's linker args verbatim to lld-link.  The previous
  *windows* branch is kept for MinGW and now explicitly excludes msvc
  (the two take different flag dialects — GNU-style -Wl,... vs MSVC
  /FLAG).

Patch pipeline refactor (prerequisite):

* Replace the sed-based patch_vendored_crate with a helper,
  apply_vendored_patch, that applies a real .patch file to a vendored
  crate directory and refreshes .cargo-checksum.json afterwards so
  cargo --frozen accepts the modified files.  The existing
  rocksdb-cross-compile-platform.patch was stale (wrong hunk line
  counts, also semantically incorrect for darwin) — replaced with
  ckb-librocksdb-sys-cross-compile.patch, regenerated from a real
  git diff.

* New patches/ckb-vm-msvc-cc-env.patch: ckb-vm 0.24.14's build.rs
  hardcodes build.compiler("gcc") for its is_msvc branch (to route
  its GNU AT&T-syntax execute_x64.S through a GNU assembler, which
  works on a native Windows machine that also has MinGW-w64's gcc
  installed alongside cl.exe).  For cross-compile from Linux, "gcc"
  resolves to the host's Linux cc which cannot emit MSVC COFF.  The
  patch adds a CKB_VM_ASM_CC env-var override — build.sh sets it to
  clang-cl, which handles GNU AT&T .S via LLVM's integrated assembler
  and produces valid MSVC-ABI COFF.

Reproducibility verified:

  x86_64-pc-windows-msvc: e31f5af8e04efde939f09d66cc3b1a77534f1cf575f5f9afc36894bdbbdd6226
    - host run 1, host run 2, docker run: all identical

The existing four targets are unaffected by the patch-pipeline refactor
(mingw re-verified post-refactor at 39901c3e..., matching the pre-refactor
hash byte-for-byte; linux/aarch64-linux never hit that code path).

The xwin SDK is user-provided.  The release flow documents pinning
\`xwin --manifest-version 17 --sdk-version 10.0.22621\` — two xwin
extractions from the same pin produce byte-identical trees (5547 files
+ 2895 symlinks, all matching), so users can either re-run xwin or
consume a pre-extracted tarball.  Microsoft's Visual Studio Build Tools
EULA applies to the SDK; xwin's --accept-license flag handles it.

Author: eval-exec

contrib/guix/guix-build

@@ -89,7 +89,7 @@ EOF
 }
 
 HOSTS="${HOSTS:-x86_64-unknown-linux-gnu}"
-SUPPORTED_HOSTS="x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu aarch64-apple-darwin"
+SUPPORTED_HOSTS="x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu x86_64-pc-windows-msvc aarch64-apple-darwin"
 for host in $HOSTS; do
     if ! echo "$SUPPORTED_HOSTS" | grep -qw "$host"; then
         echo "ERR: Unsupported HOST '$host'. Supported: $SUPPORTED_HOSTS" >&2
@@ -119,7 +119,19 @@ for host in $HOSTS; do
                 exit 1
             fi
             echo "Found macOS SDK at '${OSX_SDK}'"
-            break
+            ;;
+        *pc-windows-msvc*)
+            MSVC_SDK="${SDK_PATH}/msvc-vs17-sdk10.0.22621"
+            if [[ ! -d "$MSVC_SDK" ]]; then
+                echo "ERR: MSVC SDK not found at '${MSVC_SDK}'."
+                echo "     Extract it via xwin, pinned to the same versions we verified reproducible:"
+                echo "       cargo install xwin"
+                echo "       xwin --accept-license --manifest-version 17 --sdk-version 10.0.22621 \\"
+                echo "            splat --output '${MSVC_SDK}'"
+                echo "     The resulting tree is governed by Microsoft's Visual Studio Build Tools EULA."
+                exit 1
+            fi
+            echo "Found MSVC SDK at '${MSVC_SDK}'"
             ;;
     esac
 done
@@ -207,9 +219,11 @@ for HOST in $HOSTS; do
               --share="$OUTDIR_BASE"=/outdir-base \
               --expose="$GIT_COMMON_DIR" \
               ${OSX_SDK:+--share="$OSX_SDK"} \
+              ${MSVC_SDK:+--share="$MSVC_SDK"} \
               --cores="$JOBS" \
               -- env HOST="$MANIFEST_HOST" \
                      ${OSX_SDK:+OSX_SDK="$OSX_SDK"} \
+                     ${MSVC_SDK:+MSVC_SDK="$MSVC_SDK"} \
                      RUST_TARGET="$RUST_TARGET" \
                      VERSION="$VERSION" \
                      JOBS="$JOBS" \