Build and tools work on Linux, macOS and BSD as well as Windows

Developed from both Windows and Linux, so nothing in the build should
care which host it runs on. It did, in four places.

Toolchain: one path instead of two. clang is a cross-compiler by
construction, so a single LLVM install targets bare-metal ELF, 16/32-bit
code below 1 MB, and Linux/musl userland from any host -- which is how
the Windows build already worked. The GNU branch beside it had drifted
into passing --no-warn-rwx-segments, a hard error on lld, which is the
default linker on both FreeBSD and macOS; and it required a brewed
x86_64-elf-gcc before anything built on a Mac at all. GNU is kept as a
fallback (USE_GNU=1) but clang+lld is chosen whenever both are present.
Host tools use the host's own cc; only mingw needs naming explicitly.

tools/mkschfs.c included <sys/sysmacros.h> unconditionally on non-mingw
hosts. That header is glibc/musl only -- macOS and the BSDs have neither
the header nor a need for it, since major()/minor() come from
<sys/types.h> there. Now guarded on __linux__.

Ports verified tarballs with `sha256sum -c -`, which does not exist on
macOS (shasum), FreeBSD/NetBSD (sha256), or OpenBSD (cksum -a sha256),
and each spells its check mode differently. tools/sha256check.sh picks
whichever of the five the host has and compares digests itself.

nproc is coreutils, so absent on macOS and BSD; falls through to sysctl
-n hw.ncpu before defaulting to 4.

The PowerShell tools now run under pwsh on any OS: QEMU is found on PATH
(the scoop location is a Windows-only fallback), and path literals use
forward slashes -- Join-Path $root 'build\x' produces a *filename
containing a backslash* on a Unix host. The backslash sweep is limited
to known directory prefixes on purpose: bootcheck sends
printf 'caf\303\251' to the guest to test UTF-8, and a blanket
substitution would have quietly changed what that asserts.

Also fixes six tools left booting build/fs.img, which stopped being
bootable when SchFS became the root filesystem: crashshot, dispshot,
fbshot, splashshot, textshot and ttyshot all take build/schfs.img now,
and the -SchFS switches that used to select it are gone.

Verified on Windows: full build, and bootcheck green. The Linux, macOS
and BSD paths are written from their documented behaviour and are NOT
executed here -- this machine has no WSL and no second host.

tools/splashshot.ps1

@@ -10,19 +10,42 @@
 # Same shape as tools/crashshot.ps1: monitor on TCP because QEMU on Windows has
 # no unix sockets, serial to a logfile so the transcript survives.
 #
-#   tools\splashshot.ps1                 frames every 400ms for 8s
-#   tools\splashshot.ps1 -Every 200 -For 4
+#   tools/splashshot.ps1                 frames every 400ms for 8s
+#   tools/splashshot.ps1 -Every 200 -For 4
 
 param(
     [int]$Every = 400,        # milliseconds between frames
     [int]$For = 8,            # seconds to keep capturing
-    [string]$OutDir = "build\shots",
-    [string]$Qemu = "$env:USERPROFILE\scoop\apps\qemu\current\qemu-system-x86_64.exe"
+    [string]$OutDir = "build/shots",
+    [string]$Qemu = (Find-Qemu)
 )
 
+# QEMU, on whichever host this is.
+#
+# PowerShell 7 runs on Linux, macOS and the BSDs as well as Windows, so these
+# scripts are usable from all of them -- but the old default was a hardcoded
+# scoop path under $env:USERPROFILE, which exists on exactly one of those. PATH
+# first, because a package-managed qemu is on it everywhere; the scoop location
+# is only a fallback for the Windows install that does not add itself to PATH.
+function Find-Qemu {
+    $exe = if ($IsWindows -or $env:OS -eq 'Windows_NT') { 'qemu-system-x86_64.exe' }
+           else { 'qemu-system-x86_64' }
+    $onPath = Get-Command $exe -ErrorAction SilentlyContinue
+    if ($onPath) { return $onPath.Source }
+    if ($env:USERPROFILE) {
+        $scoop = Join-Path (Join-Path $env:USERPROFILE 'scoop/apps/qemu/current') $exe
+        if (Test-Path $scoop) { return $scoop }
+    }
+    foreach ($p in @('/usr/bin', '/usr/local/bin', '/opt/homebrew/bin')) {
+        $c = Join-Path $p $exe
+        if (Test-Path $c) { return $c }
+    }
+    throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
+}
+
 $ErrorActionPreference = 'Stop'
 $root = Split-Path $PSScriptRoot -Parent
-$log  = Join-Path $root 'build\splashshot.log'
+$log  = Join-Path $root 'build/splashshot.log'
 $dir  = Join-Path $root $OutDir
 
 Remove-Item -Recurse -Force $dir -ErrorAction SilentlyContinue
@@ -30,7 +53,11 @@ New-Item -ItemType Directory -Force $dir | Out-Null
 Remove-Item -Force $log -ErrorAction SilentlyContinue
 
 $hda = Join-Path $root 'schos.img'
-$hdb = Join-Path $root 'build\fs.img'
+# The root filesystem. SchFS is the only root there is: the kernel mounts
+# device 1 in forkret() and panics if it is not a SchFS volume, so this is
+# not a choice and there is no -SchFS switch any more. It used to default to
+# build/fs.img, which stopped being bootable the moment SchFS became root.
+$hdb = Join-Path $root 'build/schfs.img'
 
 $monPort = 55556      # not crashshot's port, so the two can run back to back
 
@@ -42,7 +69,7 @@ $psi.Arguments = @(
     # developer already has open would otherwise make this fail with "Failed to
     # get write lock" -- and a capture script is exactly the thing you want to
     # run without first shutting down what you were looking at. Copying was the
-    # first fix and it meant duplicating build\fs.img, all 153 MB of it, on
+    # first fix and it meant duplicating build/fs.img, all 153 MB of it, on
     # every run. -snapshot keeps writes in a temporary overlay, so the originals
     # are untouched either way.
     "-drive file=`"$hda`",format=raw,index=0,media=disk,file.locking=off"