#28 Refine CI and build to compile/run C examples

Summary by cubic

Refined CI and build to compile and run the C examples, rebuild the PDF when examples change, and block releases on failing code. Improved CI diagnostics and tightened security scanning.

• New Features

  • Added examples CI job on ubuntu-24.04 running .ci/check-newline.sh, .ci/check-format.sh (pinned clang-format-20), .ci/check-security.sh, .ci/check-cppcheck.sh, then make -C examples check; release now depends on build and examples; PR runs can cancel, pushes to main never do; workflow_dispatch can republish.
  • Forced PDF rebuilds when embedded examples change by deriving sources from \inputminted and running latexmk -g; cached TeX and _minted keyed on the pinned container with restore keys; cleaned/ignored generated artifacts.
  • Reworked examples/Makefile: per-target rules with override CFLAGS; detect x86-64 via compiler macros to pass -mcx16; probe -latomic; keep caller CPPFLAGS/LDFLAGS; rebuild when the toolchain/flags change via a signature stamp that includes the compiler version and safely escapes quotes; check asserts exact stdout; format uses CLANG_FORMAT; README documents C11 threads and -mcx16/libatomic.

• Bug Fixes

  • Queue correctness: never claim the idle sentinel (re-check on each CAS iteration); aligned and aligned-allocated the idle job (and 16-byte v_prev); dropped the stale front link when the queue drains; in the versioned variant, claimed with a guarded loop and published pointer+version in one 16-byte store.
  • Lifecycle/exit status: checked thrd_create and unwound cleanly; freed unclaimed futures (and results) on cancel; waited for workers to publish idle before tpool_destroy; failed runs on init/add_job/result allocation errors and reported via exit status.
  • CI checks: fixed false negatives in .ci/check-security.sh (perform translation phase 2 first, preserve line numbers, replace comments with spaces, no SIGPIPE; detect #undef _FORTIFY_SOURCE/__SSP__); .ci/check-format.sh, .ci/check-newline.sh, .ci/check-cppcheck.sh print actionable errors and clean temp files.
  • Docs/listings: made the ABA demo deterministic with a flag handshake and joins; updated the worker listing with the idle-sentinel guard and correct acquire/release orders (state load and job-pointer load are acquires; CAS failure is an acquire); minor cleanups.