fix(build): wx 'zlib.h not found' CI flake — self-heal zlib port + deterministic cache touch

Two fixes for the intermittent wx-build failure on CI (zipstrm.cpp: fatal
error: 'zlib.h' file not found, surviving the serial retry):

- build-wx-wasm.sh: --with-zlib=sys resolves to the Emscripten zlib PORT,
  which only `embuilder build zlib` installs — and that ran only in the
  configure branch. A pre-configured build dir (CI cache) + fresh emsdk
  therefore died on any recompile of a zlib-using TU. Ensure the port
  before every make; --force because embuilder stamps the port on libz.a
  alone, so a half-populated cache would no-op.

- wasm-build.yml: the cache-restore `touch {} +` stamped files ns-apart in
  readdir order; GNU make 4.x compares ns mtimes, so objects touched before
  a generated header they depend on (wx/setup.h, pcre2.h via .deps/*.d)
  recompiled — a random subset per run, which is what made the failure
  flaky. Use one shared timestamp instead: equal mtimes = up to date.

Reproduced + validated locally (remove sysroot zlib.h + one .o → exact CI
failure; with fix, self-heals in 0.5s; Linux make ns/equal-mtime behavior
verified in a container).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XeiSRRScdaox5jBueJNcyG

.github/workflows/wasm-build.yml

@@ -263,9 +263,14 @@ jobs:
           path: build-wasm/wxwidgets
           key: wx-${{ runner.os }}-${{ steps.keys.outputs.wx }}-${{ hashFiles('scripts/build-wx-wasm.sh','scripts/common/versions.sh') }}
 
+      # One shared timestamp, not per-file "now": plain `touch {} +` stamps each file
+      # a few ns apart in readdir order, and GNU make 4.x compares ns mtimes — so any
+      # object touched before a generated header it depends on (wx/setup.h, pcre2.h
+      # via .deps/*.d) looks stale and a random subset recompiles every cache-hit run.
+      # Equal mtimes read as up to date.
       - name: Mark restored wx objects current
         if: inputs.run_tests && steps.wx-cache.outputs.cache-hit == 'true'
-        run: find build-wasm/wxwidgets -exec touch {} +
+        run: find build-wasm/wxwidgets -exec touch -d "@$(date +%s)" {} +
 
       - name: Build wxWidgets (wxUniversal WASM)
         if: inputs.run_tests