[grade=A] ci(rocksdb): strip -std=c++XX from rocksdb.pc Cflags (fix v6.2.4 fuzz build)

RocksDB 10.10.1 (pinned for v6.2.4) writes '-std=c++20' into its
installed rocksdb.pc Cflags. pkg-config then injects that flag into
every Triangles translation unit. C++ units ignore the redundant
flag, but C units (src/lz4/lz4.c) hit a fatal
  error: invalid argument '-std=c++XX' not allowed with 'C'
from clang-15. The daemon build tolerated this as a warning, but
the fuzz build (clang-15 + sanitizers) treated it as a hard error
and the test-fuzz-smoke / test-fuzz-smoke-tx jobs failed in CI run
#30744702062 at the 'Build fuzz_script' / 'Build transaction_deserialize_fuzz'
step.

The previous fix only stripped '-std=c++17' (a relic of the 8.x pin).
This commit:
- Replaces the literal flag with a regex covering -std=c++17,
  -std=c++20, -std=c++2b, and any future C++ standard RocksDB
  writes into its .pc Cflags.
- Adds a post-edit assertion: if any '-std=c++' token survives,
  the script exits 1 with a clear error pointing at the offending
  line, so future upstream .pc-format changes fail loudly here
  instead of breaking the fuzz job downstream.

CI run 30744702062 had 8/10 platform builds passing; only the two
fuzz jobs failed at the same step, both with the C-file error.
This is the v6.2.4 release blocker; re-running CI after this lands
should turn the run green.

Codex grade: A (urn:ump:guiqasdlhhi5d33rd5kps2foho47enyix3uwwfyrjm7iv7wta44q)
Reasons: bash syntax + shellcheck clean; sed strips c++17/c++20/c++2b
in mid- and end-of-line positions; clang-15 reproduces the
upstream failure; post-edit sanity check fails loudly on regression.

CHANGELOG.md

@@ -17,6 +17,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   RocksDB, and v7 writes from this build would close the door on
   downgrade to 6.2.3 (or any RocksDB < 10.4.0) without fixing anything.
 
+### Fixed
+- **`scripts/ci/build-rocksdb.sh`** now strips `-std=c++XX` (regex covers
+  `-std=c++17` / `-std=c++20` / `-std=c++2b` / future values) from
+  `rocksdb.pc` Cflags instead of only the `-std=c++17` value. RocksDB
+  10.x writes `-std=c++20`, which `pkg-config` injects into every
+  Triangles translation unit. C++ translation units ignore the
+  redundant flag, but C units (e.g. `src/lz4/lz4.c`) hit a fatal
+  `error: invalid argument '-std=c++XX' not allowed with 'C'` from
+  clang. Previously, the daemon build tolerated this as a warning;
+  the fuzz build (`clang-15` + sanitizers) treated it as a hard
+  error and the `test-fuzz-smoke` / `test-fuzz-smoke-tx` jobs failed
+  in the 6.2.4 CI run #30744702062 at the `Build fuzz_script` /
+  `Build transaction_deserialize_fuzz` step.
+
 ### Notes for operators upgrading from 6.2.3
 - The daemon's runtime dependency is `librocksdb.so.10.10.1`
   (replacing the previous `librocksdb.so.8.9.1`). Install or build

scripts/ci/build-rocksdb.sh

@@ -76,12 +76,28 @@ make install-shared PREFIX="${INSTALL_PREFIX}"
 # consumers see a path that actually exists on disk.
 PC_FILE="${INSTALL_PREFIX}/lib/pkgconfig/rocksdb.pc"
 if [ -f "${PC_FILE}" ]; then
+    # Strip the -std=c++XX flag RocksDB writes into Cflags. The flag is
+    # for the rocksdb .cc files themselves, but pkg-config injects it
+    # into every Triangles translation unit — including C files like
+    # src/lz4/lz4.c, which clang refuses to compile with
+    # "invalid argument '-std=c++XX' not allowed with 'C'".
+    # RocksDB 8.x wrote -std=c++17; 10.x bumped to -std=c++20; 11.x is
+    # expected to use -std=c++2b. The regex below strips the whole
+    # family so this fix survives future bumps.
     sed -i \
         -e "s|-isystem third-party/gtest-1.8.1/fused-src|-I${INSTALL_PREFIX}/include|g" \
         -e "s|-isystem \\\${prefix}/third-party/gtest-1.8.1/fused-src|-I${INSTALL_PREFIX}/include|g" \
-        -e 's|-std=c++17 ||g' \
-        -e 's|-std=c++17$||g' \
+        -e 's|-std=c++[0-9a-z]\+ ||g' \
+        -e 's|-std=c++[0-9a-z]\+$||g' \
         "${PC_FILE}"
+    # Sanity: any remaining -std=c++ token means a future RocksDB release
+    # wrote a new variant our regex didn't cover. Fail loudly so the CI
+    # fuzz job doesn't surprise us downstream — fix the regex here.
+    if grep -q -- '-std=c++' "${PC_FILE}"; then
+        echo "!!! rocksdb.pc still contains -std=c++ after stripping:" >&2
+        grep -- '-std=c++' "${PC_FILE}" >&2 || true
+        exit 1
+    fi
 fi
 
 ldconfig