Census and gate the five native build legs that still have no baseline

[shai-almog]

Only one leg is gated today: ios-sim-debug, with 149 baseline rows. The
warning census tool, the manifest and the ratchet are all leg-agnostic and
already wired; what is missing is a first honest count on the rest.

leg	workflow / job	state
Xcode iOS Release device	ios-packaging.yml	no baseline
Xcode macOS	scripts-macos.yml / build-macos	no baseline
clang-cl Windows	parparvm-tests-windows.yml / clean-target	no baseline, no warning flags at all
clang/gcc Linux clean target	parparvm-tests.yml / vm-tests	no baseline, no warning flags at all
Linux full app + port	linux-build-run.yml	no baseline

Each is --report-only first, then --write-baseline from a run that passed
the completeness check.

Things that have already cost a fix on this tool and will bite again here:

• clang-cl -Wall IS /Wall IS -Weverything (verified from clang-cl -help: /W4 enables -Wall -Wextra; /Wall enables -Weverything). The
  Windows leg must use /W4 or /clang:-Wall, or the census is unusable.
• The two CMake generators announce compiles differently -- ninja [7/91],
  make [ 42%]. Matching only one makes a complete build read as "compiled
  nothing".
• Windows logs use backslashes, so os.path.basename on a POSIX host
  returns the whole path. Normalise separators at parse time.
• An incremental build undercounts to zero and looks like success. The iOS
  leg is the primary one precisely because it sets no shared derived data and
  compiles cold every run. Check each new leg for the same property before
  trusting its number, and rely on the completeness guard rather than on
  inspection.
• The CMake legs set no warning flags today, so their first census will be
  near-empty and that is not good news -- the real work starts when -Wall -Wextra / /W4 goes on. Add the flags first, then count.
• The macOS leg cannot attribute generated code. MacOSNativeBuilder passes
  -DconcatenateFiles=true unconditionally, so per-emitter attribution is
  impossible there; it should gate port/runtime/vendored only. That is
  fine -- the generated C is emitter-identical and the iOS leg covers it.

One coverage caveat to name out loud: scripts-ios.yml's pull_request
trigger stops firing on very large PRs that exceed GitHub's paths-filter diff
limit, and on such a PR the Apple gate reads as absent, not failing. The
nightly cron and the push: master leg still cover master.

Found by the native warning census (scripts/check-native-warnings.py).