build(windows): do not pass -z noexecstack when cross-compiling to PE

[mlandolfi90]

ELF_HARDENING_FLAGS is gated on IS_LINUX, which comes from uname and therefore describes the host. Cross-compiling to Windows from a Linux container satisfies that gate while the compiler emits PE, and the link fails:

lld: error: unknown argument: -z
clang: error: linker command failed with exit code 1

Reproduced on main with the repo's own recipe:

docker compose -f test-infrastructure/docker-compose.yml run --rm build-windows

The fix restores the flag's documented intent — the comment above it already states it is ELF-only and "meaningless for PE, so it is gated". The gate just tested the wrong end of the toolchain. IS_MINGW is derived from the compiler's own _WIN32 define, so adding it names the target rather than the host.

Native Windows CI (MSYS2 CLANG64) is unaffected: uname reports MINGW64_NT there, so IS_LINUX was already no. Linux and macOS are unaffected. Only the Linux-host → Windows-target combination changes, and only to stop emitting a flag that cannot apply.

On CONTRIBUTING's "Build system / Makefile changes — beyond trivial fixes": I read this as a trivial fix (one gate condition, no behaviour change on any venue CI builds). Happy to move it to an issue first if you would rather discuss it.

🤖 Generated with Claude Code

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.