build: fix four things a clean build found, three of them mine

`make` had been failing since the e1000 work and I did not see it, because I
was checking build output with `grep error` -- which matches neither "Błąd" nor
mkfs's "image full". Checking the exit status instead found all of this in a
minute.

**usbstick.img was full.** `make ldls-stage` puts a module and its BTF in
sysroot/lib/modules, and a vmlinux BTF is 5 MB on its own; the 16 MB test image
could not hold it. The size cannot move -- tools/windows/bootcheck.ps1 asserts
READ CAPACITY returns exactly 32768 sectors -- so the exclusions grew instead:
lib and usr as well as bin. That image exists to prove the USB driver can read
one block, so its contents were never the point. It also stopped a GPL module
riding into a test artifact, which RAMDISK_EXCLUDE does for the ramdisk and
nothing was doing for this one.

**toybox's httpd was shadowing ours.** /bin/httpd answered `-p` with toybox's
"Unknown option 'p'", because whichever install rule ran second won the name.
TOYBOX_SKIP existed for exactly this and held one entry, `ping`, found the same
hard way. It is now generated from cmd/ -- a list you have to remember is a
list that is wrong the next time cmd/ grows, and it already was: `chvt` had
been silently toybox's, whose VT ioctls are Linux's and not ours.

**ldlsd would not link with clang.** `*out = in;` on a 96-byte struct is a call
to memcpy as far as the C standard is concerned; gcc unrolled it and clang
emitted the call, so a freestanding program linked for months and then did not
on a machine where nothing about it had changed but the compiler. lib/glue.c
now provides memcpy, memmove, memset and memcmp -- the four an implementation
may call without being asked.

**OVMF was never found on NixOS.** `$(dir $(QEMU))share` is the *bin*
directory plus "share", so it looked in /usr/bin/share. The absolute paths
after it covered that up on distributions that keep firmware in /usr; on one
that keeps nothing there it meant the firmware was undiscoverable on a machine
that had it, and the only way to build was to copy the file in by hand. It
resolves the prefix properly now and looks in <prefix>/share/qemu too.

Verified by exit status, from a clean tree and a no-op: both 0. ldls-check
passes 27. The guest boots, serves /srv to the host and answers 403 to
%2e%2e/etc/passwd.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

Makefile

@@ -527,9 +527,18 @@ OVMF_VARS = $(BUILD)/OVMF_VARS.fd
 # rather than assume, and say something useful when nothing is found -- an
 # unhelpful "cp: no such file" is a poor way to learn that a package is
 # missing.
-QEMU_SHARE  = $(dir $(shell command -v $(QEMU) 2>/dev/null))share
-OVMF_CODE_CANDIDATES =     $(QEMU_SHARE)/edk2-x86_64-code.fd     /usr/share/edk2/ovmf/OVMF_CODE.fd     /usr/share/OVMF/OVMF_CODE.fd     /usr/share/ovmf/x64/OVMF_CODE.fd     /usr/share/qemu/edk2-x86_64-code.fd
-OVMF_VARS_CANDIDATES =     $(QEMU_SHARE)/edk2-i386-vars.fd     /usr/share/edk2/ovmf/OVMF_VARS.fd     /usr/share/OVMF/OVMF_VARS.fd     /usr/share/ovmf/x64/OVMF_VARS.fd     /usr/share/qemu/edk2-i386-vars.fd
+#
+# `$(dir ...)` of the binary is its *bin* directory, so the share directory is
+# one level above it -- `$(dir)/share` asked for `/usr/bin/share`, which exists
+# nowhere. On the distributions below that went unnoticed, because the absolute
+# paths after it matched anyway; on one that keeps nothing in /usr it meant the
+# firmware was never found on a machine that had it, and the only way to build
+# was to copy the file in by hand.
+QEMU_BIN    = $(shell command -v $(QEMU) 2>/dev/null)
+QEMU_PREFIX = $(patsubst %/bin/,%,$(dir $(QEMU_BIN)))
+QEMU_SHARE  = $(QEMU_PREFIX)/share
+OVMF_CODE_CANDIDATES =     $(QEMU_SHARE)/qemu/edk2-x86_64-code.fd     $(QEMU_SHARE)/edk2-x86_64-code.fd     /usr/share/edk2/ovmf/OVMF_CODE.fd     /usr/share/OVMF/OVMF_CODE.fd     /usr/share/ovmf/x64/OVMF_CODE.fd     /usr/share/qemu/edk2-x86_64-code.fd
+OVMF_VARS_CANDIDATES =     $(QEMU_SHARE)/qemu/edk2-i386-vars.fd     $(QEMU_SHARE)/edk2-i386-vars.fd     /usr/share/edk2/ovmf/OVMF_VARS.fd     /usr/share/OVMF/OVMF_VARS.fd     /usr/share/ovmf/x64/OVMF_VARS.fd     /usr/share/qemu/edk2-i386-vars.fd
 
 # Tested through the shell rather than with $(wildcard). On Windows, make is a
 # native binary using Win32 file calls while `command -v` hands back an MSYS
@@ -1125,16 +1134,28 @@ $(BUILD)/sysroot.stamp: sysroot-install
 #     4096. The size is load-bearing: tools/windows/bootcheck.ps1 asserts on
 #     READ CAPACITY returning 32768 sectors of 512 bytes, which is this.
 #
-#     --exclude bin, because this image exists to prove the USB driver can read
-#     a block and for no other reason. mkfs writes each hard link as its own
-#     copy, so once toybox's 236 applets became links to one binary the /bin
-#     tree expanded to more than 60 MB on the way in -- 236 copies of something
-#     nothing here will ever execute.
+#     The exclusions matter more than they look, because the size above cannot
+#     move to accommodate content. This image exists to prove the USB driver
+#     can read a block and for no other reason, so what is in it is irrelevant
+#     and only its total size is not.
+#
+#     --exclude bin: mkfs writes each hard link as its own copy, so once
+#       toybox's applets became links to one binary the /bin tree expanded to
+#       more than 60 MB on the way in -- hundreds of copies of something
+#       nothing here will ever execute.
+#     --exclude lib: `make ldls-stage` puts a kernel module and its BTF here,
+#       and a vmlinux BTF is 5 MB on its own. That filled this image and broke
+#       `make` for anyone who had staged a module -- a build failure a long way
+#       from its cause. It also kept somebody else's GPL module out of a test
+#       artifact, which RAMDISK_EXCLUDE does for the ramdisk and nothing was
+#       doing for this.
+#     --exclude usr: 7 MB of fonts, for a test that reads one block.
 USBSTICK = $(BUILD)/usbstick.img
 $(USBSTICK): $(MKFS) $(BUILD)/sysroot.stamp
 	@mkdir -p $(BUILD)
 	@rm -f $@
-	$(MKFS) $@ --size 4096 --exclude bin --sysroot $(SYSROOT)
+	$(MKFS) $@ --size 4096 --exclude bin --exclude lib --exclude usr \
+	    --sysroot $(SYSROOT)
 
 usbstick: $(USBSTICK)