ci: validate every member with mcpp 2026.9.28.2, and a failing member names its issue

[Sunrisepeak]

Summary

Tasks N1 and N2 of the 2026-09-28 ecosystem design (mcpp-community/mcpp .agents/docs/2026-09-28-ecosystem-design-and-optimisation-plan.md); N3 is #482.

• N1. validate.yml runs every member with mcpp 2026.9.28.2 (2026.9.28.2: one resolver for the runtime beside a Windows program, header tracking on every host, one statement per fact, conditional tables by specificity mcpp-community/mcpp#730), and latest_mcpp moves to it. On Windows the release changes what a member's build sees: one resolver decides the runtime files beside a program, every action has the toolset's runtime first on PATH (so each action re-runs once), and a GNU-dialect compile writes a depfile. Matching conditional tables now apply by selector specificity; the one descriptor with two target_cfg predicates, compat.libarchive, names two that never match one target. No descriptor grammar changed, so min_mcpp does not move.
• N2. A failing member names its issue. tests/known-red.tsv lists the members known to fail, per leg, with the issue that owns each (empty today: the scheduled sweep of 2026-09-27 passed every member). The new job red members name their issues (tests/red_members.py) reads every shard's rows, lists each failing member with its issue in the run summary, and fails when a failing member has none, or when the members' job failed and no member row can be attributed. Its seven-case self-test runs in lint.
• The sweep alert. It checks nothing out, so gh could not infer the repository and the step failed ("not a git repository"): the red sweep of 2026-09-26 opened no issue (Full sweeps of 2026-09-26 failed and were recorded nowhere; the sweep alert itself failed #482). It now sets GH_REPO, and it also runs when mirror-cn-reachable fails.

Criteria

• python3 tests/red_members.py selftest: seven cases, including a red member without an issue (fails), one with its issue (passes), an issue on another leg (fails), and a shard that failed before testing (fails).
• This pull request touches validate.yml, so select runs every member on every platform with 2026.9.28.2: the full sweep is the reading of N1, and the red members job reads it.

[speak-agent]

Full sweep dispatched on this branch (run 36376460690): every member on every leg with mcpp 2026.9.28.2, 22 workspace shards (linux default 6, linux llvm 9, macos 2, windows 5), all green. The new job red members name their issues ran on it and reports "No member failed."; the sweep alert was skipped because nothing failed.