[helly25]

Follow stable LLVM 23 updates from the pinned toolchain catalogue automatically. Major LLVM and clang-tidy upgrades remain explicit configuration decisions, while ordinary catalogue updates can pick up LLVM 23 fixes without a second compiler-version edit.

Keep Linux CI working on Ubuntu 26.04 while retaining Ubuntu 24.04 support, including real FUSE mounts on both runtimes.

AG;DR

Current implementation: 16c86d96586d7caf1624bb1b4538b4b7965c7237, synchronized with main through #1012.

Linux CI failures involve a FUSE runtime-package mismatch, LLVM tool runtime dependencies, and a setup-bazel policy mismatch. The initial failing run cannot install libfuse3-3 on Ubuntu 26.04 and cannot load the older toolchain LLD's ICU dependency. The MSan failure separately requires libxml2.so.2 for the fixed LLVM 22.1.8 compiler/runtime pair. This PR resolves the toolchain, FUSE and MSan host compatibility issues; PR 1013 carries the setup-bazel policy correction.

Implementation:

• Keep latest:major==23: select the newest stable LLVM 23 release available for the host in the pinned, checksummed toolchain catalogue. Catalogue updates can adopt LLVM 23 fixes; LLVM 24 and new major clang-tidy versions require an explicit selector change. No live upstream-release lookup is involved.
• Replace the superseded Add percentage and logarithmic benchmark scales #909 development snapshot with actual upstream master commit b63941bcc533a52e1b81c81af5fe77d5a2b382f8, using the released 1.12.0 module baseline. The immutable snapshot includes merged selector integration #911, LLVM 23.1.4 #915, and auxiliary-tool runtime-library fix #914. Linux resolves LLVM 23.1.4. Release 1.12.0 predates the selector integration, so retain this source pin until a release contains it.
• Use the normal transitive Bazel Central Registry dependency on mboworks_bzl (now 0.8.0 upstream); no bzl version, archive or Git override remains.
• Preserve LLVM_VERSION_MSAN and the exact LLVM 22.1.8 compiler/instrumented-libc++ pairing. Ordinary ASan, TSan, coverage, fuzzing, release builds, build tools, clang-format and clang-tidy follow LLVM 23. Native Apple ld and bundled Linux LLD selection remain intact.
• Run the pinned LLVM 22.1.8 MSan toolchain on Ubuntu 24.04 and explicitly install libxml2, with a distinct msan-ubuntu24 cache namespace. Its LLD requires libxml2.so.2, which Ubuntu 26.04 no longer packages (it supplies SONAME 16). Also install that dependency in the local Ubuntu 24.04 MSan Docker harness. LLVM 23 builds and the other sanitizer jobs remain on ubuntu-latest; no compiler/libc++ version mismatch or shared-library alias is introduced.
• Make the existing --help child-argument boundary test use a child shell's printf builtin. Ubuntu 26.04's uutils external printf handles --help itself even after a format operand, so the fixture previously tested the host utility's help behavior. The child still receives a literal --help, and both the child-output and no-xff-help assertions remain.
• Probe libfuse3.so.4, then .so.3, then the existing unversioned fallback. SONAME 4 still exposes the FUSE3 API. xff's used lowlevel-operations prefix, file-info fields and exported four-argument fuse_session_new compatibility entry point work with both runtimes; no new adapter or libfuse build dependency is needed.
• Install fuse3 in Linux main/release CI and the local Docker harness; its dependencies choose the distribution's runtime package rather than hard-coding libfuse3-3.
• Add an Ubuntu 24.04 default test cell alongside ubuntu-latest and macOS. Both Linux default cells require real FUSE mounts via --config=xff_fuse_tests_required; latest Linux retains ASan. Give Ubuntu 24.04 a separate compiled-output cache namespace.
• Document stable-major compiler policy and the supported FUSE runtimes in CONTRIBUTING.md and the ABI/loader comments. Compiler-module changes still select every indexed translation unit for CI clang-tidy, and all extra-module tests run with core tests in one Bazel invocation.

Validation:

• bazel build //tools:process_resources_native //xff:xff --config=clang_release --jobs=4 passes on Ubuntu 26.04 with LLVM 23.1.4, including sandboxed ThinLTO indexing/linking that previously failed on LLD's missing ICU 70 dependency (945 actions).
• All seven focused FUSE/CLI test targets pass natively on Ubuntu 26.04 with the required-mount config. The loader selects libfuse3.so.4; all kernel-path server cases run.
• The same compiled server/API/loader binaries pass in an Ubuntu 24.04 container with fuse3/libfuse3-3 3.14.0 and select libfuse3.so.3. All eight CLI full-extras cases also pass there with no skips, including actual archive mounts. This checks one binary across both supported runtimes.
• Completion audit: released bzl 0.8.0 passes all 182 Bazel tests and 46 Python tooling tests; regenerating its PEP 440 fixture with the pinned packaging==26.0 reference reports no differences. Its published version reference documents all four functions and legacy/SemVer/PEP 440 modes. Release-commit CI passes on Linux, macOS and Windows; release and site publication also succeed. At the exact pinned upstream commit, all 45 focused toolchains_llvm selector/feature/distribution tests pass, including named constants, function expressions, wildcard/compatible operators and prerelease policy. All 99 upstream checks are completed without failures, including required_checks_done.
• In a clean Ubuntu 24.04 container, packaged libxml2 2.9.14 satisfies LLVM 22.1.8 LLD. A C++23 program using std::vector compiles, links with that LLD and the exact instrumented libc++ overlay, and executes successfully under MSan. The MSan host-only update leaves the previously tested C++ sources unchanged; focused pre-commit/actionlint/shell checks pass.
• A disposable conformance audit compared xff's declarations with upstream libfuse 3.14.0 and 3.18.2 headers: the used argument/entry/file-info offsets, complete implemented operations prefix and keep-cache/file-handle representation match. Upstream headers remain outside the product build.
• bazel test //... $(tools/extras.py --wildcards) --config=xff_docs --config=clang --config=xff_fuse_tests_required --jobs=4 --test_output=errors: all 297 core/extra-module targets pass on native Ubuntu 26.04 without a GNU printf PATH override. The portable fixture preserves the child-argument regression assertion; the same xff binary demonstrates that external uutils printf prints its own help while the shell builtin prints child:--help.
• Focused pre-commit checks, including actionlint, formatting, shell policy and the release-preparation policy suite, pass; git diff --check passes. The local clang-tidy hook skips without a compile database; final-head CI passes the complete indexed scan.

The repository ignores MODULE.bazel.lock; dependency resolution refreshes it locally. Final pushed head 16c86d96586d7caf1624bb1b4538b4b7965c7237 passes the complete GitHub CI run, including macOS, Ubuntu 24.04 and 26.04 release tests, ASan/TSan/MSan, coverage, fuzzing, benchmarks, and all 294 translation units in the complete clang-tidy scan. Required done, pre-commit and trunk checks pass; the PR is mergeable and up to date with main.