G-128: non-windows-host e2e clause SATISFIED - recorded (WSL2 Ubuntu 24.04, both toolchain routes)

Progress increment 1e: route (a) hermetic cross-compile from the pinned
windows zig ran tool-level (linux punkres stamps punk91, full read-back on
linux) and seam-level (make.tcl bake punkluck86 under the WSL tclsh 8.6.14
embedded via punkres on a linux host - the exact cross-host gap this goal
closes); route (b) fetched linux zig 0.16.0 and ran the suite natively
(33/33 after the usage-pin fix) with a byte-identical stamp from the
natively-built binary. Windows confirmed both artifacts (icon bytes, twapi
inside the stamped kit, boots). Cross-host determinism recorded: linux and
windows post-hoc stamps byte-identical; the 4-byte CheckSum delta vs the
fleet artifact is the stub-time-vs-whole-file ordering artifact, both arms,
loader-ignored. Remaining acceptance item: punkbin publication route only.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

goals/G-128-portable-pe-resource-stamping.md

@@ -369,3 +369,44 @@ the parked RT_VERSION stamping wants, since the project version is known late.
   the httpfixture server) and live-verified against the real punkbin server
   from the spaced checkout; (b) suffixless `use` materializing from a sole
   matching -rN artifact - still open, user-owned.
+- 2026-07-29 increment 1e (user-directed): NON-WINDOWS-HOST END-TO-END RUN
+  DONE - the e2e acceptance clause is SATISFIED. Host (recorded per the
+  clause): WSL2 Ubuntu 24.04.4 LTS on this machine (hostname SuperBee, kernel
+  6.6.87.2-microsoft-standard-WSL2, x86_64), distro /usr/bin/tclsh 8.6.14.
+  Two toolchain routes, both run:
+  - Route (a), hermetic: punkres cross-compiled x86_64-linux-musl (static
+    ELF) from the PINNED windows zig 0.16.0 out of the vendored tree.
+    TOOL-LEVEL: that binary running UNDER LINUX stamped a punk91.exe copy
+    (4013-member archive-relative overlay preserved; converged in rebuild
+    mode on the fleet-stamped input) with the ENTIRE read-back on linux:
+    list shows RT_GROUP_ICON "PUNKSHELL", extract-ico byte-identical to
+    punkshell.ico - no windows, no twapi. SEAM-LEVEL: a punkshell clone on
+    the WSL NATIVE filesystem (staging discipline) with the win32-ix86
+    runtime and bin/punkres staged ran 'tclsh src/make.tcl bake -confirm 0
+    punkluck86' under the linux tclsh - "kit icon (G-057): embedded default
+    icon into punkluck86.exe stub via punkres" ON A LINUX HOST (the exact
+    cross-host gap this goal closes), cross-target smoke skipped as
+    designed, kit assembled and deployed.
+  - Route (b), authentic: zig-x86_64-linux-0.16.0 fetched from ziglang.org
+    into WSL; 'zig build test' NATIVE ON LINUX from the staged vendored tree
+    - 33/33 after one real finding (the CLI usage pin hardcoded punkres.exe;
+    fixed upstream f97eda2+f0af880 with comptime EXENAME splices, both
+    platforms exact-pinned; re-vendored 0bee025e, punkres 0.3.1) - and the
+    natively-built binary's stamp of the same input is BYTE-IDENTICAL to the
+    cross-built binary's.
+  WINDOWS CONFIRMATION (the clause's second half): both linux-produced
+  artifacts confirmed on windows - extract-ico byte-identical to
+  src/runtime/punkshell.ico; the linux-stamped punk91 BOOTS (9.1b0, payload
+  punk::lib 0.5.1) and confirmed its own resources via its payload twapi
+  (twapi::extract_resources: 7 icons + group PUNKSHELL); the linux-BAKED
+  punkluck86 boots on windows (8.6.10) with sidecar embedding=punkres +
+  icon_group=PUNKSHELL from the linux bake.
+  CROSS-HOST DETERMINISM finding: linux post-hoc stamp == windows post-hoc
+  stamp, byte-identical over the whole 49.6MB artifact. The only delta vs
+  the fleet-deployed punk91 is the 4-byte PE CheckSum dword (offset 0x178):
+  stub-first bakes leave the STUB-time checksum in place after payload
+  concatenation (both arms, historical status quo, loader-ignored for exes),
+  while post-hoc stamping computes the whole-file value - an ordering
+  artifact, not nondeterminism.
+  REMAINS for acceptance: only the punkbin publication route (G-123/G-006
+  channels) for no-toolchain users.