build: audit fixes — multi-arch HINT, atomic g_needs_draw, CC override, no-op cache mount

- qt/CMakeLists.txt: the multi-arch QPA-header HINT used a hardcoded
  list of aarch64-linux-gnu / x86_64-linux-gnu paths. Replace with
  ${CMAKE_LIBRARY_ARCHITECTURE} so armhf / riscv64 / any future Debian
  multiarch resolves correctly. On non-Debian distros the variable is
  empty and the HINT degrades to a noisy-but-harmless dead path
  (the OPTIONAL_COMPONENTS GuiPrivate find_package wins there anyway).

- embed-test/main.c: `g_needs_draw` is now `atomic_int`. libghostty
  action callbacks may run on a worker thread, so the prior plain
  `int` write-from-worker / read-from-main was a race with no memory
  barrier. on_action and on_framebuffer_size atomic_store(1); the
  main loop atomic_exchanges to read-and-clear in one step (a wakeup
  setting it again between the read and the draw is preserved).

- embed-test/build.sh: hardcoded `cc` is now `${CC:-cc}` so a
  toolchain override is honored.

- Dockerfile: dropped the `--mount=type=cache,target=/root/.cache/cmake`
  on the qt stage. CMake doesn't read that path; the cache mount was
  doing nothing.

Co-Authored-By: claude-flow <ruv@ruv.net>

Dockerfile

@@ -119,8 +119,7 @@ WORKDIR /src/qt
 # materialises libghostty.so as a build-tree symlink (see qt/CMakeLists.txt).
 # `--install` lays the binary, .so, .desktop entry and icon into /out
 # under the standard FHS layout (bin/, lib/, share/...).
-RUN --mount=type=cache,target=/root/.cache/cmake \
-    set -eux; \
+RUN set -eux; \
     cmake -S /src/qt -B /src/qt/build -G Ninja \
       -DCMAKE_BUILD_TYPE=Release; \
     cmake --build /src/qt/build --parallel "$(nproc)"; \

embed-test/build.sh

@@ -16,7 +16,7 @@ if [[ ! -f "$lib" ]]; then
   exit 1
 fi
 
-cc -std=c11 -Wall -Wextra -g \
+"${CC:-cc}" -std=c11 -Wall -Wextra -g \
   -o "$here/harness" \
   "$here/main.c" \
   -I "$root/include" \

embed-test/main.c

@@ -27,7 +27,10 @@ typedef struct {
 static ghostty_surface_t g_surface = NULL;
 
 // Set when libghostty asks for a redraw; the main loop then draws.
-static int g_needs_draw = 1;
+// libghostty action callbacks may run on a worker thread, so this
+// must be atomic to pair the write in on_action with the read in
+// the main loop.
+static atomic_int g_needs_draw = 1;
 
 // Count of presented frames. A nonzero value confirms the OpenGL
 // embedded render path is producing frames.
@@ -74,7 +77,7 @@ static bool on_action(ghostty_app_t app, ghostty_target_s target,
   // libghostty requests a redraw via the render action; the main loop
   // services it. Other actions are ignored by this harness.
   if (action.tag == GHOSTTY_ACTION_RENDER) {
-    g_needs_draw = 1;
+    atomic_store(&g_needs_draw, 1);
     return true;
   }
   return false;
@@ -143,7 +146,7 @@ static void on_framebuffer_size(GLFWwindow *win, int w, int h) {
   (void)win;
   if (g_surface && w > 0 && h > 0) {
     ghostty_surface_set_size(g_surface, (uint32_t)w, (uint32_t)h);
-    g_needs_draw = 1;
+    atomic_store(&g_needs_draw, 1);
   }
 }
 
@@ -252,9 +255,10 @@ int main(int argc, char **argv) {
     }
 
     // libghostty requested a draw (via the render action); service it
-    // on this thread.
-    if (g_needs_draw) {
-      g_needs_draw = 0;
+    // on this thread. atomic_exchange clears the flag and reads it in
+    // one step, so a wakeup setting it again between the read and
+    // the draw is preserved for the next iteration.
+    if (atomic_exchange(&g_needs_draw, 0)) {
       ghostty_surface_draw(surface);
     }
 

qt/CMakeLists.txt

@@ -141,12 +141,15 @@ else()
   # parent dir as a private include (the header lives at
   # <prefix>/QtGui/<version>/QtGui/qpa/qplatformnativeinterface.h, so we
   # add the dir containing the `qpa` subfolder).
+  # Multi-arch Debian uses ${CMAKE_LIBRARY_ARCHITECTURE} (e.g.
+  # aarch64-linux-gnu) for include and lib subdirs. Hardcoding a list
+  # missed armhf/riscv64; deriving from the toolchain handles every
+  # arch the Qt 6 packages support.
   find_path(QT_QPA_INCLUDE_DIR
     NAMES qpa/qplatformnativeinterface.h
     HINTS
       "${Qt6Gui_PRIVATE_INCLUDE_DIRS}"
-      "${Qt6_DIR}/../../../include/aarch64-linux-gnu/qt6/QtGui/${Qt6_VERSION}/QtGui"
-      "${Qt6_DIR}/../../../include/x86_64-linux-gnu/qt6/QtGui/${Qt6_VERSION}/QtGui"
+      "${Qt6_DIR}/../../../include/${CMAKE_LIBRARY_ARCHITECTURE}/qt6/QtGui/${Qt6_VERSION}/QtGui"
       "${Qt6_DIR}/../../../include/qt6/QtGui/${Qt6_VERSION}/QtGui"
     PATH_SUFFIXES
       "qt6/QtGui/${Qt6_VERSION}/QtGui"