build: enforce strict Makefile execution

[AlexStocks]

Summary

• make help the default, documented Make entry point and add a short description for every supported public target
• run Make recipes through Bash with deterministic errexit, nounset, and pipefail semantics on both GNU Make 3.81 and 4.3
• disable implicit built-in rules and suffix rules, and delete failed file targets
• preserve actionable preflight errors when optional OceanBase or real-provider variables are unset
• pin the extensionless Makefile to LF and cover it in the Windows checkout contract
• replace source-text assertions with real Make execution tests for the default goal, failed pipelines, and missing credentials

Rationale

WP0-C in #3 requires strict, discoverable, repository-owned developer commands. The original implementation used .SHELLFLAGS, which GNU Make 3.81 silently ignored, and Bash nounset masked two existing configuration errors on newer Make versions. This revision keeps the strict contract portable across the supported developer environments while preserving the target-specific guidance.

This PR is stacked on #31 (codex/wp0-windows-contract) and now includes the current base at 22485138835f805f507c05fe62ab0c4af31c9a3b.

Behavior, API, and compatibility

• no public API, protocol, dependency, generated-contract, persistence, or runtime behavior changes
• invoking make prints the same supported-command list as make help
• recipes stop on unset variables, failed commands, and failed pipeline members
• missing optional credential variables still return the repository's actionable error messages
• a failed file target is removed by Make rather than left as a reusable partial artifact
• Makefile is checked out with LF even when core.autocrlf=true

Validation

• Windows GNU Make 3.81: default/help, failed-pipeline, and missing-credential behavior tests
• WSL GNU Make 4.3: the same behavior tests and direct Base-versus-Head regression probes
• go test ./tools/release -run '^Test(BareMakeListsSupportedTargets|MakefileRejectsFailedPipelines|MakefileMissingCredentialTargetsKeepActionableErrors|FrozenTextAssetsDeclareLFCheckout|BuildAllUsesReadonlyModuleResolution|CoverageTargetUsesRaceAtomicProfileAndThreshold)$' -count=1
• cross-compiled Linux tools/release test binary: PASS for the complete package suite
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/windows-contract.yml .github/workflows/master.yml .github/workflows/codeql.yml
• git diff --check
• exact-Head GitHub Actions: all visible checks passed, including Windows contract, go-compat, lint, quality, tests, coverage, CodeQL, race/fuzz/module integrity, Standard/Full platform matrices, OceanBase, and both acceptance profiles

Exact head validated: 81fda8cfc21c9aa207e2dcff052961e97b4b27f0.

AI usage

Implemented and reviewed with Codex assistance. The final five-file Diff, red/green regression behavior, base synchronization, Linux package tests, Windows/WSL Make behavior, and exact-Head CI results were verified directly.