Fail build-all loudly; cap cbor2 <6 on PyPy/Windows only (#1859)

The post-merge 26.6.1 dev release failed strict fileset validation with a
missing pypy311-win-amd64 wheel. Two defects:

1. build-all (justfile) swallowed per-interpreter build failures: a failing
   'just build <venv>' did not fail the recipe (no set -e; the loop ended in
   'ls'), so the Windows wheels job went green while silently omitting a wheel.
   Now build-all attempts all interpreters but exits non-zero if any failed,
   naming them - the same false-green class as #1856 / zlmdb#116.

2. The PyPy/Windows build aborted installing the core dependency cbor2: cbor2
   6.x is Rust/pyo3-only (no PyPy/Windows wheel, and the pure-Python fallback +
   CBOR2_BUILD_C_EXTENSION toggle were removed in the 6.0 rewrite), so pip built
   from sdist and the pyo3 link failed (unresolved PyPyModule_FromDefAndSpec2,
   a known pyo3-on-PyPy/Windows limitation). Cap cbor2 < 6 *only* on PyPy/Windows
   via environment markers - the 5.x line ships a pure-Python wheel and runs at
   near-native speed on PyPy - while keeping cbor2 6.x everywhere else.

PyPy/Windows is kept as a build target and a required release artifact; the
native NVX build is attempted there (it was never reached before, since cbor2
aborted first). If NVX itself turns out not to compile on PyPy/Windows, the
now-loud build-all will surface it and we retreat to excluding PyPy/Windows.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

docs/changelog.rst

@@ -29,6 +29,8 @@ Changelog
 * Bump the ``.cicd`` (wamp-cicd) submodule to pick up the script/shell-injection fix in the shared ``identifiers.yml`` reusable workflow (untrusted GitHub event fields are now passed via ``env:`` as quoted data with a fail-closed branch-name allowlist) (#1856)
 * Fail wheel builds hard when NVX was requested (``AUTOBAHN_USE_NVX``) but the CFFI extension did not compile, instead of silently degrading to a pure-Python (``py3-none-any``) wheel. A transient native-compile crash (e.g. a ``gcc`` SIGSEGV under QEMU ARM64 emulation) now aborts the build with a non-zero exit so CI can retry it, rather than uploading a structurally valid but unintended artifact. Building with ``AUTOBAHN_USE_NVX=0`` still produces a pure-Python wheel as before (#1856)
 * Fix NVX native-extension builds breaking under cross-compilation (e.g. Buildroot/Yocto for aarch64), where the cross toolchain rejected the host-only ``-march=native`` flag (``unknown value 'native' for '-march'``). The default architecture target is now the portable baseline for *all* build contexts (wheels, local source installs, and cross-compilation), with ``-march=native`` available opt-in via ``AUTOBAHN_ARCH_TARGET=native``. The target architecture is detected via ``sysconfig.get_platform()`` so the correct baseline is chosen when cross-compiling. Thanks to @jameshilliard for the original report and approach (#1834, #1835)
+* Fail the ``just build-all`` recipe (non-zero exit) when any per-interpreter wheel build fails, naming the interpreter(s). Previously a failed build was silently swallowed, producing a green wheels job with a missing wheel that was only caught downstream by strict release fileset validation (#1859)
+* Cap ``cbor2 < 6`` on PyPy/Windows only (via environment markers), keeping ``cbor2`` 6.x everywhere else. ``cbor2`` 6.x is Rust/pyo3-only with no PyPy/Windows wheel and no pure-Python fallback, so it cannot be installed on PyPy/Windows; the 5.x line ships a pure-Python wheel (and runs at near-native speed on PyPy). This unblocks building and installing autobahn on PyPy/Windows (#1859)
 
 25.12.2
 -------

justfile

@@ -1635,10 +1635,24 @@ build-sourcedist venv="": (install-build-tools venv)
 # Meta-recipe to run `build` on all environments
 build-all:
     #!/usr/bin/env bash
+    # Build a wheel for every interpreter in ENVS. Attempt ALL interpreters (do
+    # not stop at the first failure, so the report is complete), but FAIL the
+    # recipe with a non-zero exit if any single build failed, naming them. A
+    # silently swallowed per-interpreter failure here previously produced a green
+    # job with a missing wheel, only caught downstream by release fileset
+    # validation (#1859).
+    set -uo pipefail
+    failed=()
     for venv in {{ENVS}}; do
-        just build ${venv}
+        if ! just build "${venv}"; then
+            failed+=("${venv}")
+        fi
     done
     ls -la dist/
+    if [ "${#failed[@]}" -ne 0 ]; then
+        echo "ERROR: wheel build failed for interpreter(s): ${failed[*]}" >&2
+        exit 1
+    fi
 
 # Clean build artifacts
 clean-build:

pyproject.toml

@@ -51,7 +51,12 @@ dependencies = [
     "msgpack>=1.0.2; platform_python_implementation == 'CPython'",
     "u-msgpack-python>=2.1; platform_python_implementation != 'CPython'",
     "ujson>=4.0.2",  # Binary wheels for both CPython and PyPy
-    "cbor2>=5.2.0",  # Binary wheels + pure Python fallback
+    # cbor2 6.x is Rust/pyo3-only: no PyPy/Windows wheel and no pure-Python
+    # fallback, so it cannot be installed on PyPy/Windows. Cap < 6 there (the 5.x
+    # line ships a pure-Python wheel and runs at near-native speed on PyPy),
+    # while using cbor2 6.x everywhere else. See #1859.
+    "cbor2>=5.2.0; platform_python_implementation != 'PyPy' or sys_platform != 'win32'",
+    "cbor2>=5.2.0,<6; platform_python_implementation == 'PyPy' and sys_platform == 'win32'",
     # NOTE: the WAMP "ubjson" serializer (bjdata) is an OPTIONAL extra, NOT a base
     # dependency: bjdata pulls in numpy, which we don't want in a minimal install.
     # See the [serialization] extra below. This also fixes #1849 (the old, wheel-less