Build and tools work on Linux, macOS and BSD as well as Windows

Developed from both Windows and Linux, so nothing in the build should
care which host it runs on. It did, in four places.

Toolchain: one path instead of two. clang is a cross-compiler by
construction, so a single LLVM install targets bare-metal ELF, 16/32-bit
code below 1 MB, and Linux/musl userland from any host -- which is how
the Windows build already worked. The GNU branch beside it had drifted
into passing --no-warn-rwx-segments, a hard error on lld, which is the
default linker on both FreeBSD and macOS; and it required a brewed
x86_64-elf-gcc before anything built on a Mac at all. GNU is kept as a
fallback (USE_GNU=1) but clang+lld is chosen whenever both are present.
Host tools use the host's own cc; only mingw needs naming explicitly.

tools/mkschfs.c included <sys/sysmacros.h> unconditionally on non-mingw
hosts. That header is glibc/musl only -- macOS and the BSDs have neither
the header nor a need for it, since major()/minor() come from
<sys/types.h> there. Now guarded on __linux__.

Ports verified tarballs with `sha256sum -c -`, which does not exist on
macOS (shasum), FreeBSD/NetBSD (sha256), or OpenBSD (cksum -a sha256),
and each spells its check mode differently. tools/sha256check.sh picks
whichever of the five the host has and compares digests itself.

nproc is coreutils, so absent on macOS and BSD; falls through to sysctl
-n hw.ncpu before defaulting to 4.

The PowerShell tools now run under pwsh on any OS: QEMU is found on PATH
(the scoop location is a Windows-only fallback), and path literals use
forward slashes -- Join-Path $root 'build\x' produces a *filename
containing a backslash* on a Unix host. The backslash sweep is limited
to known directory prefixes on purpose: bootcheck sends
printf 'caf\303\251' to the guest to test UTF-8, and a blanket
substitution would have quietly changed what that asserts.

Also fixes six tools left booting build/fs.img, which stopped being
bootable when SchFS became the root filesystem: crashshot, dispshot,
fbshot, splashshot, textshot and ttyshot all take build/schfs.img now,
and the -SchFS switches that used to select it are gone.

Verified on Windows: full build, and bootcheck green. The Linux, macOS
and BSD paths are written from their documented behaviour and are NOT
executed here -- this machine has no WSL and no second host.

tools/sha256check.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+# Verify a file's SHA-256 against an expected hex digest, on any host.
+#
+#   tools/sha256check.sh <expected-hex> <file>
+#
+# There is no one checksum command across the supported hosts. Linux and Git
+# Bash have coreutils' sha256sum; macOS ships shasum(1) and no sha256sum;
+# FreeBSD and NetBSD ship sha256(1) with a different output format again;
+# OpenBSD has sha256 too but usually reached through cksum -a sha256. A recipe
+# that hardcodes any one of them builds on some of the hosts this project
+# supports and fails on the rest, and the failure arrives only when someone
+# first runs `make ports` on a Mac.
+#
+# Compares digests rather than trusting a -c flag, because the -c input format
+# differs between the implementations as well.
+
+set -eu
+
+if [ $# -ne 2 ]; then
+    echo "usage: $0 <expected-sha256> <file>" >&2
+    exit 2
+fi
+
+expected="$1"
+file="$2"
+
+if [ ! -f "$file" ]; then
+    echo "sha256check: no such file: $file" >&2
+    exit 1
+fi
+
+actual=
+if command -v sha256sum >/dev/null 2>&1; then
+    actual=$(sha256sum "$file" | cut -d' ' -f1)
+elif command -v shasum >/dev/null 2>&1; then
+    actual=$(shasum -a 256 "$file" | cut -d' ' -f1)
+elif command -v sha256 >/dev/null 2>&1; then
+    # FreeBSD/NetBSD: -q prints the digest alone.
+    actual=$(sha256 -q "$file")
+elif command -v cksum >/dev/null 2>&1 && cksum -a sha256 /dev/null >/dev/null 2>&1; then
+    # OpenBSD.
+    actual=$(cksum -a sha256 "$file" | sed 's/.*= *//')
+elif command -v openssl >/dev/null 2>&1; then
+    actual=$(openssl dgst -sha256 "$file" | sed 's/.*= *//')
+else
+    echo "sha256check: no usable checksum tool found" >&2
+    echo "  looked for: sha256sum, shasum, sha256, cksum, openssl" >&2
+    exit 1
+fi
+
+# Case-insensitive: openssl and sha256 have been known to differ here.
+expected_lc=$(printf '%s' "$expected" | tr 'A-Z' 'a-z')
+actual_lc=$(printf '%s' "$actual"   | tr 'A-Z' 'a-z')
+
+if [ "$expected_lc" != "$actual_lc" ]; then
+    echo "sha256check: checksum mismatch for $file" >&2
+    echo "  expected: $expected_lc" >&2
+    echo "  actual:   $actual_lc" >&2
+    exit 1
+fi
+
+echo "$file: OK"