[Rosetta-9] Modernize C, C++, Clang and toolchains

[k5602]

Goal

Unify compiler baselines. Update format and lint. Fix old Find modules. Document toolchain per tier.

Known debt

• cmake/CompileOptions.cmake:37-59 gates GNU 4.9 plus, Clang 3.6 plus, MSVC 1930, then sets CXX_STANDARD 11 and C_STANDARD 11 with fallback to 99. Many tests already use cxx_std_17. c_loader and plugin_extension require 17 for optional and filesystem. Core and tests drift.
• AGENTS.md claims C23 and C++23 default with C17 fallback. CMake says C11 and C++11. Docs must state one truth.
• .github/workflows/clang-format.yml:18 pins clang-format-version: 12. Team decision: use latest clang-format. .clang-format:1-110 uses LLVM base, UseTab: Always, ColumnLimit: 0, UseCRLF: true. CRLF plus tabs cause noisy diffs on Linux and macOS. Team decision: use LF.
• cmake/ClangDevTools.cmake:19-37 leaves clang-tidy commented out. Only clang-format target exists. No tidy CI.
• cmake/FindNodeJS.cmake keeps vs2017 branches and Node 12 logic. cmake/FindLibClang.cmake, FindLibTCC.cmake, FindLibFFI.cmake predate current LLVM and runtime releases. No clear minimum host compiler table per OS.
• cmake/SecurityFlags.cmake, cmake/Warnings.cmake lack unified -Wall -Wextra -Werror -fsanitize=address,undefined story with CompileOptions.cmake sanitizer blocks.

Tasks

• Decide baseline and record it: proposal is C17 minimum plus C++17 minimum, allow C23 and C++23 where toolchain supports it. Update cmake/CompileOptions.cmake and all cxx_std_17 uses to one variable. Remove C99 fallback or state where it still applies.
• Use latest clang-format in workflow, not pinned old major. Set .clang-format to LF only (UseCRLF: false), review tab policy, set sane ColumnLimit, keep LLVM base only if team agrees. Run format once as separate PR to keep diff reviewable.
• Enable clang-tidy in cmake/ClangDevTools.cmake with small initial checks: bugprone-*, clang-analyzer-*, modernize-use-nullptr, readability-braces-around-statements. Run warnings-only first, then enforce in CI per Tier 1.
• Update Find modules: FindNodeJS, FindLibClang, FindLibTCC, FindDotNET, FindWasmtime, FindJulia. Drop EOL branches such as vs2017 and Node 12 paths. Add version floor checks with clear fatal messages.
• Publish host toolchain table per Rosetta-3 tiers: Tier 1 Linux x86-64 GCC and Clang floors, Tier 2 macOS ARM64 AppleClang floor plus Windows MSVC floor. Include CMake, Ninja, Python host deps.
• Sync docs: update Rosetta-1 reference, Rosetta-4 build options, Rosetta-7 contributing flow, root AGENTS.md build flags. State sanitizer flow: ASan plus UBSan, TSan, MSan, memcheck.
• Verify with clean builds: Linux GCC, Linux Clang, plus one Tier 2 host where possible. Run ctest, clang-format check, tidy run.

Non-goals

• No loader runtime upgrades here. Track per-loader upgrades separately.
• No full cpp_loader here. Track under Rosetta-3 Tier 3.
• No CMake minimum version bump unless required for new features. Propose separately if needed.

Acceptance

• One baseline table merged and linked from contributing guide.
• Format check green on latest clang-format with LF only, zero CRLF.
• Tidy runs in CI warnings-only with zero new high-severity hits.
• Find modules fail fast with clear message on unsupported hosts.
• Tier 1 build plus tests green on GCC and Clang.