feat(dist): bundled-zig link backend for hermetic macOS/Linux/Windows builds

Drive a bundled `zig` as `zig cc` for the AOT link step, supplying lld + CRT
+ libc (musl/glibc/mingw) so `sx build` produces native binaries with no host
toolchain. Default Linux output is static musl (portable-anywhere).

- src/zig_backend.zig: discover zig ($SX_ZIG / bundled-next-to-exe / PATH);
  bundled-vs-PATH provenance gates auto-activation.
- src/target.zig: selectZigLinker + emitZigLinkArgv + zigTargetTriple, dispatched
  before the per-OS branches; macOS/Linux/Windows in scope.
- src/ir/emit_llvm.zig: LLVMNormalizeTargetTriple so vendor-less zig triples
  (e.g. x86_64-windows-gnu) parse to the correct OS/object format (COFF not ELF).
- src/main.zig: --self-contained / --no-self-contained; linux-musl, linux-musl-arm,
  windows-gnu shorthands; de-vendor linux/linux-arm to match the corpus runner.
- examples/1660: Windows Win32 print-42 + exit(0) via kernel32 (ir-only off-Windows).

Auto-activates only for a bundled zig; a PATH-only zig engages under
--self-contained, so native dev/CI builds are never silently rerouted.

Docs: readme Cross-Compilation, design/bundled-zig-link-backend-design.md, current/PLAN-DIST.md.

readme.md

@@ -685,12 +685,34 @@ if p.json { /* emit ONLY machine output on stdout */ }
 ## Cross-Compilation
 
 ```sh
-sx build app.sx --target linux          # Linux x86_64
+sx build app.sx --target linux          # Linux x86_64 (glibc, dynamic)
+sx build app.sx --target linux-musl     # Linux x86_64 (musl, static)
 sx build app.sx --target macos-arm      # macOS ARM64
-sx build app.sx --target windows        # Windows x86_64
+sx build app.sx --target windows        # Windows x86_64 (MSVC)
+sx build app.sx --target windows-gnu    # Windows x86_64 (MinGW)
 sx build app.sx --target wasm           # WebAssembly
 ```
 
+### Self-contained builds (bundled `zig`)
+
+For macOS / Linux / Windows targets, sx can link with a bundled `zig` as
+`zig cc` instead of the host's system linker — it supplies lld, the CRT, and
+libc (musl/glibc/mingw), so no `cc`/SDK needs to be installed. The default
+Linux output is statically-linked musl, which runs on any Linux.
+
+```sh
+sx build app.sx --target linux-musl --self-contained   # static, portable ELF
+sx build app.sx --self-contained                       # host target, hermetic link
+SX_ZIG=/path/to/zig sx build app.sx --self-contained   # pin a specific zig
+sx build app.sx --no-self-contained                    # force the system toolchain
+```
+
+`--self-contained` uses a `zig` found via `$SX_ZIG`, a bundled copy next to the
+`sx` binary, or `zig` on `PATH`. In a packaged distribution (with a bundled
+`zig` alongside `sx`) the backend activates automatically; a `PATH`-only `zig`
+is used only when `--self-contained` is passed, so native dev builds are never
+silently rerouted. Set `SX_DEBUG_ZIG=1` to trace discovery.
+
 ## Acknowledgments
 
 - [Jonathan Blow](https://en.wikipedia.org/wiki/Jonathan_Blow) for Jai, the language that inspired this one