ci: run the orphaned test/db regression runners (and make them portable)

[gburd]

test/db/ holds four runners that each guard a specific fixed bug, but none was invoked by any CI job or build target — so a regression in the code they cover would have gone unnoticed.

Runner	Guards
run_hash_unsorted_cmp	the #139 hash comparator fix (PR #144)
run_recd_compact	compact-path recovery
run_recd_handlers	recovery handler dispatch
run_upgrade	the on-disk upgrade path

How this surfaced

While double-checking that the #139 fix on master really contains both required changes. It does — LEN_HKEY(dbp, p, dbp->pgsize, i) for the stored item's length and res = t->h_compare(...) capturing the result. The second matters: with only the reported half, a prefix search key compares equal against a truncated view of the stored key, turning the false negative into a false positive (get("acct") returning acct0000's data). The test proving this is thorough — false-negative, false-positive-on-prefix, over-long key, and DB_NOOVERWRITE — but nothing ran it.

Wiring them up exposed three real portability bugs

Enabling them on the existing build matrix made all four macOS jobs fail, each time for a different reason. All three were genuine latent defects in the runners, not CI noise:

1. Library probe was Linux-only — looked for .libs/libdb-*.so; macOS builds libdb-5.3.dylib.
2. timeout is GNU coreutils — absent on stock macOS (rc=127). Added a run_with_timeout helper: timeout → gtimeout → run without one. Losing the timeout beats a false failure. Both branches exercised explicitly, including that the fallback drops the seconds argument.
3. Root cause — the .dylib's baked-in install name (/usr/local/BerkeleyDB.5.3/lib/...) takes precedence over -Wl,-rpath on macOS, so the binary aborted in dyld against an uninstalled path. The runners never needed dynamic linking, so they now prefer libdb.a (what test/fuzz already does) and only fall back to shared. Also replaced hardcoded gcc with "${CC:-cc}", which would have been the next failure.

Verification

• Locally 4/4 PASS, and ldd hash_unsorted_cmp | grep -c libdb = 0, confirming the static link.
• On macOS: Compiling hash_unsorted_cmp against ./libdb.a then all four .sh: PASS.
• Full matrix green; actionlint clean for the new step.

No engine changes.

[github-actions]

Coccinelle convention checks

No new violations. ✅

Resolved since baseline (2) -- update dist/cocci/baseline.txt to lock these in.

rule_mutex_unbalanced|MUTEX_UNBALANCED|src/crypto/mersenne/mt19937db.c|return (ret);
rule_mutex_unbalanced|MUTEX_UNBALANCED|src/mp/mp_register.c|return (ret);

[github-actions]

ABI diff vs v5.3.34 (libabigail — authoritative)

Functions changes summary: 0 Removed, 0 Changed, 2 Added functions
Variables changes summary: 0 Removed, 0 Changed, 0 Added variable

2 Added functions:

  [A] 'function int __lock_sireap_lockers(ENV*)'    {__lock_sireap_lockers}
  [A] 'function int __os_csprng(ENV*, void*, size_t)'    {__os_csprng}

Removed exported symbols (nm -D, _NNNN version suffix normalized)

None.

---

Advisory: libabigail/nm is the authoritative binary-ABI check; Coccinelle is complementary source-level early warning. See dist/cocci/README.md.