fix(ci): unblock CI by fixing 4 pre-existing failure modes

Every CI run on master since 2026-04-14 has been failing due to four
distinct infrastructure issues, none caused by source code. This commit
addresses all four.

(1) Bun silent-compile failure on ubuntu runners
----------------------------------------------------------------
`bun build --compile --target=bun-linux-x64-musl` on GitHub's
ubuntu-24.04 runners exits 0 without producing a binary. The same target
works locally on macOS. The smoke step then ENOENTs trying to execute
the missing file.

Fix: scripts/build.ts now verifies the output file exists and is
non-empty after each compile. If Bun exits 0 but produced no file, we
retry up to 3 times and then fail loudly with an explicit error instead
of pretending success. The retry loop also covers (3) below.

(2) Cross-compile targets in the smoke matrix
----------------------------------------------------------------
Even if the musl binaries WERE produced, they can't run on a glibc
runner — musl and glibc use different dynamic linkers. Smoke-testing
linux-*-musl targets on ubuntu-24.04 is fundamentally wrong.

Fix: introduce scripts/build-config.ts::isTargetRunnableOnHost(), which
encodes the "which target can run on which host" matrix (linux glibc
only runs linux glibc, musl requires a musl host, etc). scripts/
cli-binary-smoke.ts now filters the requested targets through this
predicate and skips (rather than tries to execute) non-runnable ones.

(3) Windows CDN flake on bun-windows-x64-baseline
----------------------------------------------------------------
"Failed to extract executable for 'bun-windows-x64-baseline-v1.3.12'.
The download may be incomplete." — intermittent Bun CDN download
corruption, not our code.

Fix: the same 3-attempt retry loop in (1) also retries transient Bun
exec failures. Additionally, the CI matrix now drops windows-x64-baseline
and linux-*-musl from build targets entirely — they were never
shipped via npm publish anyway (publish runs `bun run build`, not
`build:cli`), and building them on CI only produces false red runs.

Split the matrix into buildTargets (what we compile on this runner)
and smokeTargets (what we actually execute with `--help`). On Linux
runners both lists are equal now (all glibc, no musl). On Windows we
keep `windows-x64` and `windows-x64-modern` but drop the flaky
baseline variant.

(4) Scheduled cch-drift workflow can't create issues
----------------------------------------------------------------
HttpError: "Issues has been disabled in this repository." The workflow
tries to POST /issues on drift detection, but the repo has Issues
disabled in settings.

Fix: .github/workflows/cch-drift.yml now writes a $GITHUB_STEP_SUMMARY
entry and uploads the drift-report artifact instead of opening an
issue. The `issues: write` permission is removed. Drift detection
still fails the job (visible on the Actions tab), just without
creating noise in a disabled Issues view.

Extras
----------------------------------------------------------------
- .gitignore: ignore `.*.bun-build` (Bun's transient compile working
  files — root cause of the "file 2.ts" duplicates that appeared
  earlier this session).
- scripts/build-config.test.ts: 5 new tests for isTargetRunnableOnHost
  covering darwin/linux/win32 hosts and the CLI_BINARY_TARGETS
  classification on Linux.

Verification
----------------------------------------------------------------
- 80 test files / 1374 tests + 5 skipped (up from 1369 — added 5 in
  build-config.test.ts).
- lint, typecheck, format all clean.
- Local smoke: `bun run build:cli -- --targets=darwin-arm64 &&
  bun scripts/cli-binary-smoke.ts --targets=darwin-arm64,linux-x64,
  linux-x64-musl` correctly builds darwin-arm64, runs its --help,
  and SKIPS the two linux targets with an explicit "cannot execute
  on darwin" message.

Scope note
----------------------------------------------------------------
Users who want musl or windows-x64-baseline binaries can still build
them locally via `bun run build:cli -- --targets=linux-x64-musl` etc.
The targets are not removed from CLI_BINARY_TARGETS — just from the
CI matrix where they can't be validated.