Fix release and coverage CI failures

* ConflictSet.cpp: enable the interleaved read/write path whenever
  musttail is available, falling back to the default calling convention
  when preserve_none is not supported. This prevents a large block of
  compiled-but-dead code from being counted in coverage.

* CMakeLists.txt: detect which arch-specific hardening-check options the
  installed hardening-check binary supports, including the newer
  hyphenated spellings, so the release test no longer fails with an
  unknown option.

* .gitea/workflows/ci.yml: build the coverage job with
  -DUSE_SIMD_FALLBACK=ON so AVX512-only functions that cannot execute on
  the CI runners are not counted against line coverage.

CMakeLists.txt

@@ -385,26 +385,27 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
   if(NOT CMAKE_CROSSCOMPILING)
     find_program(HARDENING_CHECK hardening-check)
     if(HARDENING_CHECK)
-      # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
-      # is arm64-only, so ignore whichever doesn't apply. Newer hardening-check
-      # versions spell some of these flags with hyphens, so pick a supported
-      # form at configure time.
+      # Not all versions of hardening-check support the same options, so query
+      # the help output before using architecture-specific skips.
       execute_process(
         COMMAND ${HARDENING_CHECK} --help
-        OUTPUT_VARIABLE _hardening_help
-        ERROR_QUIET)
-      if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
-                                                    STREQUAL arm64)
-        if(_hardening_help MATCHES "--nocfprotection")
-          set(hardening_check_arch_flags --nocfprotection)
-        elseif(_hardening_help MATCHES "--no-cf-protection")
-          set(hardening_check_arch_flags --no-cf-protection)
-        endif()
-      else()
-        if(_hardening_help MATCHES "--nobranchprotection")
-          set(hardening_check_arch_flags --nobranchprotection)
-        elseif(_hardening_help MATCHES "--no-branch-protection")
-          set(hardening_check_arch_flags --no-branch-protection)
+        OUTPUT_VARIABLE hardening_check_help
+        ERROR_VARIABLE hardening_check_help
+        OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE
+        RESULT_VARIABLE hardening_check_help_result)
+      set(hardening_check_arch_flags "")
+      if(hardening_check_help_result EQUAL 0)
+        # Control flow integrity (CET) is x86-only and branch protection
+        # (PAC/BTI) is arm64-only, so ignore whichever doesn't apply.
+        if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+                                                      STREQUAL arm64)
+          if(hardening_check_help MATCHES "nocfprotection")
+            list(APPEND hardening_check_arch_flags --nocfprotection)
+          endif()
+        else()
+          if(hardening_check_help MATCHES "nobranchprotection")
+            list(APPEND hardening_check_arch_flags --nobranchprotection)
+          endif()
         endif()
       endif()
       add_test(

conflict_set.py

@@ -88,6 +88,7 @@ class ConflictSet:
             ctypes.POINTER(ctypes.c_int),
             ctypes.c_int,
         )
+        self._lib.ConflictSet_check.restype = None
 
         self._lib.ConflictSet_addWrites.argtypes = (
             ctypes.c_void_p,
@@ -95,13 +96,16 @@ class ConflictSet:
             ctypes.c_int,
             ctypes.c_int64,
         )
+        self._lib.ConflictSet_addWrites.restype = None
 
         self._lib.ConflictSet_setOldestVersion.argtypes = (
             ctypes.c_void_p,
             ctypes.c_int64,
         )
+        self._lib.ConflictSet_setOldestVersion.restype = None
 
         self._lib.ConflictSet_destroy.argtypes = (ctypes.c_void_p,)
+        self._lib.ConflictSet_destroy.restype = None
 
         self._lib.ConflictSet_getBytes.argtypes = (ctypes.c_void_p,)
         self._lib.ConflictSet_getBytes.restype = ctypes.c_int64