Fix Docker macOS timestamp issues and improve build reproducibility

- Add rsync-based source sync for Docker builds to fix macOS VirtioFS
  timestamp inconsistencies that caused autoconf sanity checks to fail
- Add config.sub wrapper (SHELL/CONFIG_SHELL) to support emscripten/wasm32
  targets without modifying submodule files
- Fix protobuf build to use native gcc/g++ for protoc instead of Emscripten
- Add python PATH fix for macOS (Homebrew's python3 symlink) in wxWidgets build

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

scripts/build-wxuniversal-wasm.sh

@@ -17,11 +17,25 @@
 
 set -e
 
+# Ensure 'python' command is available (macOS only has python3)
+# Homebrew's python libexec has the python -> python3 symlink
+if [[ -d "/opt/homebrew/opt/python/libexec/bin" ]]; then
+    export PATH="/opt/homebrew/opt/python/libexec/bin:$PATH"
+elif [[ -d "/usr/local/opt/python/libexec/bin" ]]; then
+    export PATH="/usr/local/opt/python/libexec/bin:$PATH"
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
 BUILD_DIR="$PROJECT_ROOT/build-wasm/wxwidgets-universal"
 WX_SOURCE="$PROJECT_ROOT/wxwidgets"
 
+# Use our config.sub wrapper for autoconf projects
+# CONFIG_SHELL is critical: nested configures (pcre, etc.) do SHELL=${CONFIG_SHELL-/bin/sh}
+# Without CONFIG_SHELL, nested configures would reset SHELL to /bin/sh and bypass our wrapper
+export SHELL="$SCRIPT_DIR/config/config-sub-wrapper.sh"
+export CONFIG_SHELL="$SCRIPT_DIR/config/config-sub-wrapper.sh"
+
 # Use JOBS from env.sh if set, otherwise use all available cores
 JOBS="${JOBS:-$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)}"
 

scripts/common/env.sh

@@ -11,6 +11,12 @@ export PROJECT_ROOT="$_KICAD_WASM_PROJECT_ROOT"
 export SCRIPTS_DIR="$_KICAD_WASM_SCRIPTS_DIR"
 export COMMON_DIR="$_KICAD_WASM_COMMON_DIR"
 
+# Use our config.sub wrapper for autoconf projects (emconfigure)
+# This intercepts config.sub calls to use our version with emscripten/wasm32 support
+# CONFIG_SHELL is critical: nested configures do SHELL=${CONFIG_SHELL-/bin/sh}
+export SHELL="$SCRIPTS_DIR/config/config-sub-wrapper.sh"
+export CONFIG_SHELL="$SCRIPTS_DIR/config/config-sub-wrapper.sh"
+
 # Build output directories (inside the project)
 export BUILD_ROOT="$PROJECT_ROOT/build-wasm"
 export DEPS_ROOT="$BUILD_ROOT/deps"

scripts/config/config-sub-wrapper.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# SHELL wrapper that intercepts config.sub calls and uses our updated version
+# This allows building with autoconf projects without modifying their config.sub files
+#
+# How it works:
+# - autoconf's configure runs: $SHELL "${ac_aux_dir}config.sub" $host_alias
+# - By exporting SHELL to point to this script, we intercept these calls
+# - When $1 ends with "config.sub", we use our version instead
+# - All other invocations pass through to real bash
+
+WRAPPER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+OUR_CONFIG_SUB="$WRAPPER_DIR/config.sub"
+
+# Check if we're being asked to execute a config.sub script
+# configure calls: $SHELL "path/to/config.sub" <args>
+if [[ "$1" == *config.sub ]]; then
+    # Use our config.sub instead, passing all remaining arguments
+    exec "$OUR_CONFIG_SUB" "${@:2}"
+fi
+
+# For all other invocations, pass through to real bash
+exec /bin/bash "$@"

scripts/deps/build-protobuf.sh

@@ -62,8 +62,11 @@ if [ ! -f "${PROTOC_NATIVE}" ]; then
     cd "${PROTOBUF_HOST_BUILD}"
 
     # Build native (not cross-compiled) protoc
+    # Explicitly use system compilers to avoid Emscripten (which is in PATH)
     cmake "${PROTOBUF_DIR}" \
         -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_C_COMPILER=/usr/bin/gcc \
+        -DCMAKE_CXX_COMPILER=/usr/bin/g++ \
         -Dprotobuf_BUILD_TESTS=OFF \
         -Dprotobuf_BUILD_EXAMPLES=OFF \
         -Dprotobuf_BUILD_SHARED_LIBS=OFF \