ci: verify portable public SDK builds

[AlexStocks]

Summary

• define the deliberate public SDK package set with ./api/..., ./artifact/..., ./client/..., ./inference/..., ./openapi/..., ./source/..., and ./trigger/...
• cross-build it with CGO_ENABLED=0 for the existing supported Linux and macOS amd64/arm64 matrix
• make every target iteration explicitly fail the Make recipe when its build fails
• retain the stable portable-sdk CI job and workflow topology contract

Rationale

This is part of WP0-C in #3. A self-review found that the initial target list was incomplete and that the loop depended on shell fail-fast behavior. The exact submitted version now uses the same four-platform matrix as the repository's existing platform jobs, includes openapi and all Artifact subpackages, and exits explicitly on each failed compilation.

PR #35 provides a parallel main-based implementation for the same work item. This PR remains a corrected stacked implementation.

Behavior and compatibility

• no public API, protocol, dependency, runtime, or generated-contract changes
• does not claim Windows server/release support
• rejects any CGO dependency or cross-platform build break introduced into the deliberate public package set

Validation

• GOTOOLCHAIN=local GOFLAGS=-mod=readonly make portable-sdk
• mutation: make portable-sdk PORTABLE_SDK_PACKAGES=./internal/sqlstore/sqlitevec fails as expected with CGO_ENABLED=0
• go test ./...
• make lint (0 issues)
• make check
• make check-generated
• make license-check
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• git diff --check

Exact head validated: eac7fbdc9dcf0c62e57a3f25d49d34cf9c195005.

AI usage

Implemented with Codex assistance. The public package set and fail-fast behavior were self-reviewed and verified with the commands above.

[AlexStocks]

Found a gate-integrity issue in make portable-sdk while implementing the same WP0-C item (see #35 for a parallel implementation):

The recipe runs go build inside a for loop without checking each iteration's exit status:

@for target in $(PORTABLE_SDK_TARGETS); do \
    GOOS=$${target%/*} GOARCH=$${target#*/} CGO_ENABLED=0 $(GO) build -mod=readonly $(PORTABLE_SDK_PACKAGES); \
done

A POSIX for loop only returns the last iteration's exit status, so if linux/amd64 fails but windows/amd64 (the last target) succeeds, make portable-sdk exits 0 and CI stays green despite a broken platform. Repro:

$ sh -c 'for t in first second; do if [ "$t" = first ]; then false; else true; fi; done; echo $?'
0

Suggested fix: fail each iteration, e.g. go build ... || exit 1 (or set -e semantics per iteration).

Two smaller gaps worth considering:

• PORTABLE_SDK_TARGETS omits linux/arm64 and darwin/arm64, which the existing platform matrix in migration-gates.yml already covers.
• The package allowlist omits ./openapi (a deliberate public package per AGENTS.md) and needs manual updates whenever an artifact subpackage is added — ./artifact/... style wildcards avoid the drift.