Add style checks and fix what they exposed

[jserv]

This branch gives shecc one way to check its own style, runnable identically by a contributor and by CI, and then follows through on what became visible once those checks could be trusted. make check-style covers trailing newlines, clang-format 20, commentflow comment reflow, and shfmt with ShellCheck; make indent rewrites exactly the set the checks cover; make install-hooks puts the same checks in front of a commit without making the tools mandatory to have; and make check-hooks tests that machinery.

The recurring defect this turned up is a check that reports success without having checked. check-newline.sh called file(1) without verifying it was installed, so a machine lacking it blocked commits on a bogus violation instead of standing aside, and it never noticed a short reply that would silently reclassify the rest of the tree. All four checkers sourced common.sh without checking that it loaded. Separately, make sanitizer shared its object file with the ordinary build, so after any plain build -- which make check performs -- it relinked an uninstrumented object against the sanitizer runtime and make check-sanitizer ran the whole suite having intercepted nothing. Counted in symbols: 32 __asan references after a clean sanitizer build, 1 after a plain one.

Removing -Wno-uninitialized needs a __noreturn macro on the three diagnostic exits, and that macro expands to nothing under __SHECC__ -- which is how a latent preprocessor bug surfaced. shecc hangs or crashes on any macro with an empty replacement list, ordinary C that the tree had simply never contained. pp_preprocess_internal() leaves its list head uninitialized and hands the caller a pointer into a frame that is about to die, so an empty expansion builds a cycle in the token list. It presented as a self-compile spinning forever in pp_strip_layout(), nowhere near the preprocessor.

With that fixed, all ten -Wno- flags come out of CFLAGS_TO_CHECK. Four hid nothing on either compiler; the rest were hiding work, including an uninitialized read in build_r_idom() that its forward twin has always guarded against. Twenty-four sites also printed a diagnostic and then abort()ed, which discards the buffer, so the MAX_TYPES guard wrote zero bytes into a build log, and error_at() now exits rather than aborting, finishing for source errors what c77b8be started for the command line.

The last commit splits the four functions that had grown past reading: emit_ph2_ir() 1543 lines to 398, read_body_statement() 896 to 63, reg_alloc() 830 to 155, lex_token() 737 to 28. It is code motion, and was checked as such rather than asserted: a frozen copy of the compiler's own source, compiled by the compiler built before and after the split, is byte-identical on all three targets. That is a stronger claim than the suite makes, since stage1 == stage2 only proves the compiler is deterministic.

Verified on arm, riscv and x64: each bootstraps with stage1 byte-identical to stage2 and passes all four suites. gcc and clang both report zero warnings on all three targets with nothing suppressed. Sixteen adversarial inputs -- deep nesting, long identifiers, unterminated literals, exhausted limits -- draw no AddressSanitizer or UndefinedBehaviorSanitizer report from a build that is now genuinely instrumented. Every commit in the series builds and passes make check-style on its own.

Deliberately left out: the file-scope objects stay as they are. There are 120, not the larger number a naive grep suggests; none is dead and none is used by only one function, so the count reflects genuinely shared state, and the context-struct alternative would spend one of only eight parameter slots on every signature.

---

Summary by cubic

Adds a style-checking pipeline (make check-style, make indent, make install-hooks, make check-hooks) that CI and contributors run identically, then fixes the real defects the checks exposed: the sanitizer build ran uninstrumented no matter how it was reached, empty macro expansions crashed the preprocessor, and ten -Wno- flags were hiding warnings including an uninitialized read. The last commit splits four oversized functions as pure code motion.

Style checks

• make check-style covers newlines, clang-format 20, commentflow reflow, and shfmt/ShellCheck; make indent rewrites exactly what the checks cover and now also adds final newlines.
• Checks exit 0 clean, 1 violation, 2 could-not-run, and only 1 blocks a commit; missing tools, an unreadable index, and sparse-checkout paths all stand aside instead of reporting clean.
• File enumeration now happens in the current shell so a git failure actually exits 2, collects only regular files, and cleans up its temp listing on interrupt; the pre-commit hook treats only exit 2 as advisory, and file lists are passed with -- to avoid dash-prefixed paths.
• make install-hooks refuses to link a hook a linked worktree would silently run as nothing and never replaces an existing hook; make check-hooks tests both refusals and the staged-snapshot judging.

Bugs the checks exposed

• make sanitizer and make check-sanitizer both now carry the sanitizer flags and build into out/sanitize, so instrumentation can no longer drop out of either entry point.
• Macros with empty replacement lists hung or crashed shecc by building a cycle in the token list; the empty splice is now skipped.
• Removed all ten -Wno- flags; the hidden warnings included an uninitialized read in build_r_idom(), 134 opcode bytes implicitly narrowed in emit_byte() (now int), and thirteen () declarations.
• error_at() and its fallbacks now exit with status 1 instead of aborting, and the print-then-abort sites flush so diagnostics reach build logs.
• Split emit_ph2_ir(), read_body_statement(), reg_alloc(), and lex_token(); output is byte-identical on all three targets.

^{Written for commit 8672866. Summary will update on new commits.}