ci: validate every member with mcpp 2026.9.28.2, and a failing member names its issue - #483

Summary

Tasks N1 and N2 of the 2026-09-28 ecosystem design (mcpp-community/mcpp .agents/docs/2026-09-28-ecosystem-design-and-optimisation-plan.md); N3 is #482.

• N1. validate.yml runs every member with mcpp 2026.9.28.2 (2026.9.28.2: one resolver for the runtime beside a Windows program, header tracking on every host, one statement per fact, conditional tables by specificity mcpp-community/mcpp#730), and latest_mcpp moves to it. On Windows the release changes what a member's build sees: one resolver decides the runtime files beside a program, every action has the toolset's runtime first on PATH (so each action re-runs once), and a GNU-dialect compile writes a depfile. Matching conditional tables now apply by selector specificity; the one descriptor with two target_cfg predicates, compat.libarchive, names two that never match one target. No descriptor grammar changed, so min_mcpp does not move.
• N2. A failing member names its issue. tests/known-red.tsv lists the members known to fail, per leg, with the issue that owns each (empty today: the scheduled sweep of 2026-09-27 passed every member). The new job red members name their issues (tests/red_members.py) reads every shard's rows, lists each failing member with its issue in the run summary, and fails when a failing member has none, or when the members' job failed and no member row can be attributed. Its seven-case self-test runs in lint.
• The sweep alert. It checks nothing out, so gh could not infer the repository and the step failed ("not a git repository"): the red sweep of 2026-09-26 opened no issue (Full sweeps of 2026-09-26 failed and were recorded nowhere; the sweep alert itself failed #482). It now sets GH_REPO, and it also runs when mirror-cn-reachable fails.

Criteria

• python3 tests/red_members.py selftest: seven cases, including a red member without an issue (fails), one with its issue (passes), an issue on another leg (fails), and a shard that failed before testing (fails).
• This pull request touches validate.yml, so select runs every member on every platform with 2026.9.28.2: the full sweep is the reading of N1, and the red members job reads it.