ci(release): install NASM on Windows, and prove the binaries have their drivers - #197

…ir drivers

The win32-x64 leg failed, which cancelled the rest of the release:

  NASM not found - make sure it's installed and available on %PATH%
  Failed module: library openssl builder for Windows

OpenSSL's Windows build assembles with NASM. It was present on the runner
image until it was not, and `spc doctor --auto-fix` only repairs the
prerequisites it knows about, so it reported a clean bill of health and the
build died much later inside the openssl module with nothing pointing at the
real cause. Installing it explicitly also puts the responsibility here rather
than on whatever the image ships next month.

Unlike the musl failures this is not transient, so there is nothing to retry:
it would have failed identically on every attempt.

The same log carried a quieter problem. pdo_pgsql is built against libpq
copied out of the postgresql-win archive, and every one of those copies had
failed:

  PHP Warning: copy(...\pgsql\lib\libpq.lib): No such file or directory
  PHP Warning: copy(...\pgsql\include\libpq-fe.h): No such file or directory

Warnings, not errors, so the build continues. The smoke test then ran
`--version`, which passes whether or not a single database driver made it in
— so a Postgres diff tool with no Postgres support would have shipped and
looked healthy.

The smoke test now points each driver at a closed port. PDO reports a missing
driver as exactly "could not find driver" and an unreachable server as a
connection error, which distinguishes the two without needing a live database.
Verified both ways locally: a working binary passes, and a stub that emits the
missing-driver message exits 1.

Applied to release-dry-run.yml as well, so the dry run keeps testing what the
release does.

Co-Authored-By: Claude <noreply@anthropic.com>

The patch that added the NASM step and the driver smoke tests located the end
of a step by searching forward for the next "- name:". The Windows smoke test
is the last step in its job, so that search ran past the end of the job and
the replacement swallowed everything up to the next step in the *following*
job — taking the artifact upload and a whole job with it.

actionlint caught it:

  job "publish-npm" needs job "github-release" which does not exist
  job "pr-comment" needs job "npm-dry-run" which does not exist

Both files are restored from master and re-patched by exact string match, so
nothing depends on where the next step happens to be. Job counts now match
master exactly (5 and 4), and the diff against master removes precisely the
two one-line `run:` commands it is meant to replace.

actionlint now runs clean across every workflow, checked locally rather than
discovered in CI.

Co-Authored-By: Claude <noreply@anthropic.com>