ci: 工具链安装是 job 的准备工作,不该由碰巧排第一的成员承担

grpc-codegen 在 linux 上死于 compat.openssl 的 install():
`stdlib.h: No such file or directory`。同一个成员在 macOS(那里
openssl 用 /usr/bin/cc)和 windows 上都过,而它的姊妹 grpc-module
排在第二、工具链已就位,构建同一个 openssl 毫无问题。

差别只有一个:它是本 shard 第一个成员,于是承担了 mcpp 的一次性
工具链自举 —— 并且是在**它自己的**环境里承担的。带自定义
`[indices]` 的成员用的是项目局部 xlings home
(<member>/.mcpp/.xlings),而 openssl 走自己的 Makefile、用裸 gcc,
头文件搜索完全来自 xvm shim 的 --sysroot;那个 sysroot 指到项目局部
subos,它的 usr/include 是空的。

于是 job 的成败取决于成员**顺序**。这一步用一个没有 [indices] 的
最小工程把工具链装进共享 home,一次,单独一个进程,在任何成员开始
之前。这本身也更诚实:job 该显式准备自己的环境,而不是继承上一个
测试留下的副作用。

Author: Sunrisepeak

.github/workflows/validate.yml

@@ -575,6 +575,41 @@ jobs:
         run: |
           "$MCPP" index update
 
+      # ── The toolchain is job setup, not the first member's problem ──────
+      # mcpp installs a default toolchain on first use ("First run no
+      # toolchain configured — installing gcc@16.1.0"). Without this step
+      # that one-time, job-wide install lands inside whichever member the
+      # shard happens to run first, and it lands there under THAT member's
+      # environment — for a member with custom `[indices]`, a project-local
+      # xlings home under <member>/.mcpp/.xlings.
+      #
+      # That made the outcome depend on member ORDER. tests/examples/
+      # grpc-codegen, first in its shard, died in compat.openssl's install()
+      # with `stdlib.h: No such file or directory`: openssl builds through
+      # its own Makefile with a bare `gcc`, so it takes the header search
+      # from the xvm shim's `--sysroot`, which resolved to the project-local
+      # subos — a tree with an empty usr/include. The very same member
+      # passed on macOS (openssl uses /usr/bin/cc there) and on windows, and
+      # its sibling grpc-module, running SECOND with the toolchain already
+      # in place, built the same openssl fine.
+      #
+      # A trivial project with no `[indices]` puts the toolchain in the
+      # shared home, once, in its own process, before any member runs. It is
+      # also just honest CI: a job should provision its environment
+      # explicitly rather than inherit it from a test that ran earlier.
+      - name: Install the toolchain (so no member absorbs the first-run install)
+        shell: bash
+        env:
+          MCPP_INDEX_MIRROR: GLOBAL
+        run: |
+          # mktemp -d, not $RUNNER_TEMP: on windows that variable is a native
+          # path (D:\a\_temp) and this step runs under bash.
+          warm="$(mktemp -d)"
+          mkdir -p "$warm/src"
+          printf '[package]\nname = "toolchain-warmup"\nversion = "0.1.0"\n' > "$warm/mcpp.toml"
+          printf 'int main() { return 0; }\n' > "$warm/src/main.cpp"
+          cd "$warm" && "$MCPP" build
+
       - name: mcpp test (workspace or affected members)
         shell: bash
         env: