SDK: preserve user linker order after platform glue

[brandonpayton]

Purpose

Make normal Autoconf linker output, including an explicit -lc, work through the Kandelo SDK without pulling musl syscall definitions ahead of Kandelo glue overrides.

Implementation

• place channel_syscall/compiler runtime glue and crt1 before user executable link inputs
• preserve the original user source, object, archive, -L, and -l ordering
• retain the final SDK-owned libc archive after user inputs
• document the executable link-order contract

This matches the ordering already used by the packaged shell SDK driver. It also prevents dependency archives from being scanned before the objects that reference them.

Validation

• scripts/dev-shell.sh bash -c "cd sdk && npm test" (7 files, 53 tests passed)
• scripts/dev-shell.sh bash scripts/build-musl.sh
• scripts/dev-shell.sh ./sdk/bin/wasm32posix-cc programs/echo.c -lc -o /private/tmp/kandelo-sdk-explicit-libc.wasm
• scripts/dev-shell.sh wasm-validate --enable-threads --enable-exceptions --enable-function-references /private/tmp/kandelo-sdk-explicit-libc.wasm
• wasm-objdump confirmed the artifact exports _start, __stack_pointer, and __abi_version; the ABI function returns 18

Scope

No ABI, runtime, kernel, package artifact, or host behavior changes. Broader kernel/host/POSIX suites were not run because this is confined to SDK argument construction and a real link was exercised.

[github-actions]

Phase B-1 matrix build status — pr-899-staging

ABI v18. 64 built, 5 failed, 69 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	50e3c530
libcxx	wasm32	built	524db0e2
libcxx	wasm64	built	c5b56c58
libpng	wasm32	built	4d5f45f6
libxml2	wasm32	failed	—
libxml2	wasm64	failed	—
openssl	wasm32	built	bf9b8e50
openssl	wasm64	built	68344b54
sqlite	wasm32	built	194ce9b7
sqlite	wasm64	built	697fffea
zlib	wasm32	built	9ebeb4dc
zlib	wasm64	built	2509453b
bc	wasm32	built	ddd03e3f
bzip2	wasm32	built	e3d717dc
coreutils	wasm32	built	aad0c1c9
curl	wasm32	built	41d45f06
dash	wasm32	built	db396c86
diffutils	wasm32	built	11cdba19
dinit	wasm32	built	124873b5
fbdoom	wasm32	built	15282a69
file	wasm32	built	99d8cf4b
findutils	wasm32	built	c994209e
gawk	wasm32	built	3336adcd
git	wasm32	built	97effa95
grep	wasm32	built	116466ea
gzip	wasm32	built	3523d135
hello	wasm32	built	6707f245
kandelo-sdk	wasm32	built	81ce5af3
kernel	wasm32	built	5ffebfb2
less	wasm32	built	70bbb897
lsof	wasm32	built	5c36c7dd
m4	wasm32	built	e26c7d6d
make	wasm32	built	e5ff797a
mariadb	wasm32	built	c2b29b49
mariadb	wasm64	built	15f5f916
modeset	wasm32	built	6999473f
msmtpd	wasm32	built	03cb9d4a
nano	wasm32	built	6e4c3b2d
ncurses	wasm32	built	a1562412
netcat	wasm32	built	01fb17af
nginx	wasm32	built	77bb0d9f
php	wasm32	failed	—
posix-utils-lite	wasm32	built	8108cda5
ruby	wasm32	built	aba0b55b
sed	wasm32	built	41b4f7a6
spidermonkey	wasm32	built	09f95a1a
tar	wasm32	built	71a2f375
tcl	wasm32	built	4b02619f
unzip	wasm32	built	e2a4cc8c
userspace	wasm32	built	507ca545
vim	wasm32	built	e5ba1eee
wget	wasm32	built	4d9eb9ee
xz	wasm32	built	8ffbc2bc
zip	wasm32	built	25513cf7
zstd	wasm32	built	b60122bb
bash	wasm32	built	3f0029fe
mariadb-test	wasm32	built	83fc76a3
mariadb-vfs	wasm32	built	c3dc4f11
mariadb-vfs	wasm64	built	d932ea3a
nethack	wasm32	built	53c91259
node	wasm32	built	cc8c5352
spidermonkey-node	wasm32	built	334620c4
vim-browser-bundle	wasm32	built	fcab0c69
nethack-browser-bundle	wasm32	built	760139bc
rootfs	wasm32	built	db23dad3
shell	wasm32	built	91107deb
lamp	wasm32	failed	—
node-vfs	wasm32	built	051f4bb4
wordpress	wasm32	failed	—

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}