Fix release and coverage CI failures

* ConflictSet.cpp: enable the interleaved read/write path whenever
  musttail is available, falling back to the default calling convention
  when preserve_none is not supported. This prevents a large block of
  compiled-but-dead code from being counted in coverage.

* CMakeLists.txt: detect which arch-specific hardening-check options the
  installed hardening-check binary supports, including the newer
  hyphenated spellings, so the release test no longer fails with an
  unknown option.

* .gitea/workflows/ci.yml: build the coverage job with
  -DUSE_SIMD_FALLBACK=ON so AVX512-only functions that cannot execute on
  the CI runners are not counted against line coverage.

CMakeLists.txt

@@ -385,27 +385,26 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
   if(NOT CMAKE_CROSSCOMPILING)
     find_program(HARDENING_CHECK hardening-check)
     if(HARDENING_CHECK)
-      # Not all versions of hardening-check support the same options, so query
+      # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
-      # the help output before using architecture-specific skips.
+      # is arm64-only, so ignore whichever doesn't apply. Newer hardening-check
+      # versions spell some of these flags with hyphens, so pick a supported
+      # form at configure time.
       execute_process(
         COMMAND ${HARDENING_CHECK} --help
-        OUTPUT_VARIABLE hardening_check_help
+        OUTPUT_VARIABLE _hardening_help
-        ERROR_VARIABLE hardening_check_help
+        ERROR_QUIET)
-        OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE
+      if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
-        RESULT_VARIABLE hardening_check_help_result)
+                                                    STREQUAL arm64)
-      set(hardening_check_arch_flags "")
+        if(_hardening_help MATCHES "--nocfprotection")
-      if(hardening_check_help_result EQUAL 0)
+          set(hardening_check_arch_flags --nocfprotection)
-        # Control flow integrity (CET) is x86-only and branch protection
+        elseif(_hardening_help MATCHES "--no-cf-protection")
-        # (PAC/BTI) is arm64-only, so ignore whichever doesn't apply.
+          set(hardening_check_arch_flags --no-cf-protection)
-        if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+        endif()
-                                                      STREQUAL arm64)
+      else()
-          if(hardening_check_help MATCHES "nocfprotection")
+        if(_hardening_help MATCHES "--nobranchprotection")
-            list(APPEND hardening_check_arch_flags --nocfprotection)
+          set(hardening_check_arch_flags --nobranchprotection)
-          endif()
+        elseif(_hardening_help MATCHES "--no-branch-protection")
-        else()
+          set(hardening_check_arch_flags --no-branch-protection)
-          if(hardening_check_help MATCHES "nobranchprotection")
-            list(APPEND hardening_check_arch_flags --nobranchprotection)
-          endif()
         endif()
       endif()
       add_test(

conflict_set.py

@@ -88,7 +88,6 @@ class ConflictSet:
             ctypes.POINTER(ctypes.c_int),
             ctypes.c_int,
         )
-        self._lib.ConflictSet_check.restype = None
 
         self._lib.ConflictSet_addWrites.argtypes = (
             ctypes.c_void_p,
@@ -96,16 +95,13 @@ class ConflictSet:
             ctypes.c_int,
             ctypes.c_int64,
         )
-        self._lib.ConflictSet_addWrites.restype = None
 
         self._lib.ConflictSet_setOldestVersion.argtypes = (
             ctypes.c_void_p,
             ctypes.c_int64,
         )
-        self._lib.ConflictSet_setOldestVersion.restype = None
 
         self._lib.ConflictSet_destroy.argtypes = (ctypes.c_void_p,)
-        self._lib.ConflictSet_destroy.restype = None
 
         self._lib.ConflictSet_getBytes.argtypes = (ctypes.c_void_p,)
         self._lib.ConflictSet_getBytes.restype = ctypes.c_int64