tools: group scripts by what runs them

tools/windows/   .ps1   (pwsh, so usable from Linux and macOS too)
  tools/posix/     .sh
  tools/python/    .py
  tools/           .c and .pl

The .c and .pl files stay at the top level because they are not
host-specific: the build compiles or invokes them on every platform.

Call sites updated in the Makefile, ports/mk/port.mk, docs and the
project memory. The one thing that does not survive a move on its own is
a script deriving the repo root from its own location -- all nine
PowerShell tools used Split-Path $PSScriptRoot -Parent, and memory-sync.sh
used dirname/.., both of which quietly become tools/ one level deeper.
Two levels now.

Two pre-existing Windows failures surfaced while verifying, both real and
neither caused by the move:

  - schfs_fsck.c did not compile under mingw at all: --extract uses
    POSIX mkdir(path,mode), symlink() and link(), none of which mingw
    has. That took the whole tool with it, and `make schfs-check` with
    it. mkdir maps to _mkdir; symlink and link fail loudly rather than
    writing a regular file in their place, because an extracted tree
    that differs from the image while reporting success defeats the
    point of --extract.
  - the round-trip test then failed at `ln -s`, since Git Bash cannot
    create symlinks without developer mode. It skips with a message now.
    Not a fudge: mkschfs's mingw build cannot see a symlink either, so
    the test would have compared a tree with none against an image with
    none and called it a pass -- coverage reporting itself as present
    while being absent.

Verified on Windows: build clean, all seven bootcheck suites green,
make schfs-check passes.

tools/sha256check.sh

@@ -1,62 +0,0 @@
-#!/bin/sh
-# Verify a file's SHA-256 against an expected hex digest, on any host.
-#
-#   tools/sha256check.sh <expected-hex> <file>
-#
-# There is no one checksum command across the supported hosts. Linux and Git
-# Bash have coreutils' sha256sum; macOS ships shasum(1) and no sha256sum;
-# FreeBSD and NetBSD ship sha256(1) with a different output format again;
-# OpenBSD has sha256 too but usually reached through cksum -a sha256. A recipe
-# that hardcodes any one of them builds on some of the hosts this project
-# supports and fails on the rest, and the failure arrives only when someone
-# first runs `make ports` on a Mac.
-#
-# Compares digests rather than trusting a -c flag, because the -c input format
-# differs between the implementations as well.
-
-set -eu
-
-if [ $# -ne 2 ]; then
-    echo "usage: $0 <expected-sha256> <file>" >&2
-    exit 2
-fi
-
-expected="$1"
-file="$2"
-
-if [ ! -f "$file" ]; then
-    echo "sha256check: no such file: $file" >&2
-    exit 1
-fi
-
-actual=
-if command -v sha256sum >/dev/null 2>&1; then
-    actual=$(sha256sum "$file" | cut -d' ' -f1)
-elif command -v shasum >/dev/null 2>&1; then
-    actual=$(shasum -a 256 "$file" | cut -d' ' -f1)
-elif command -v sha256 >/dev/null 2>&1; then
-    # FreeBSD/NetBSD: -q prints the digest alone.
-    actual=$(sha256 -q "$file")
-elif command -v cksum >/dev/null 2>&1 && cksum -a sha256 /dev/null >/dev/null 2>&1; then
-    # OpenBSD.
-    actual=$(cksum -a sha256 "$file" | sed 's/.*= *//')
-elif command -v openssl >/dev/null 2>&1; then
-    actual=$(openssl dgst -sha256 "$file" | sed 's/.*= *//')
-else
-    echo "sha256check: no usable checksum tool found" >&2
-    echo "  looked for: sha256sum, shasum, sha256, cksum, openssl" >&2
-    exit 1
-fi
-
-# Case-insensitive: openssl and sha256 have been known to differ here.
-expected_lc=$(printf '%s' "$expected" | tr 'A-Z' 'a-z')
-actual_lc=$(printf '%s' "$actual"   | tr 'A-Z' 'a-z')
-
-if [ "$expected_lc" != "$actual_lc" ]; then
-    echo "sha256check: checksum mismatch for $file" >&2
-    echo "  expected: $expected_lc" >&2
-    echo "  actual:   $actual_lc" >&2
-    exit 1
-fi
-
-echo "$file: OK"