[build] Fix build failure on non-English Windows

[ppenna]

📖 Description

On a non-English Windows (reported on French), running build.bat panicked
in the nanvix_binaries build script with certutil output not UTF-8, even
without the --with-microvm flag. This PR fixes both the immediate crash and
the underlying reason the NanVix download ran at all on a default build.

Two changes:

1. Locale-robust checksum parsing (src/backends/nanvix/binaries/build.rs).
   certutil_sha256() read certutil's stdout via
   String::from_utf8(...).expect(...). On localized Windows, certutil emits
   its header/footer lines (e.g. "Hachage SHA256 de …", "… s'est terminée
   correctement.") in the console's OEM code page (CP850), not UTF-8 — bytes
   like 0xA0, 0x92, 0xE9 are invalid UTF-8 and the strict conversion
   panicked. Switched to String::from_utf8_lossy (the SHA256 line is pure
   ASCII and survives lossy conversion) and made hash extraction
   locale-independent by scanning for the 64-char hex line instead of relying
   on a fixed line index.

2. Gate the NanVix download behind the microvm feature. nanvix_binaries
   is an unconditional workspace member, so a plain cargo build compiled it
   and ran its build script — which gated only on the target OS, never on
   whether the micro-VM backend was requested. --with-microvm only added
   --features microvm (gating the nanvix_runner link and the SDK copy step)
   and never reached the download path. The crate now has a microvm feature;
   its build.rs early-returns (emitting only NANVIX_BIN_DIR, still required
   by lib.rs's env!) when CARGO_FEATURE_MICROVM is unset — no download, no
   certutil, no snapshot generation. wxc and lxc enable
   nanvix_binaries/microvm through their own microvm features, so the
   download path runs exactly when --with-microvm is requested. build.bat
   needs no change.

Net effect: a default build.bat on any locale no longer triggers the NanVix
download/certutil step; the crate still compiles (cheap lib + early-returning
build script), only the network/hashing work is skipped.

🔗 References

Closes #498

🔍 Validation

• cargo build -p nanvix_binaries (no feature): compiles, performs no
  download/certutil.
• cargo build -p wxc --features microvm: build script runs its full path
  (binaries verified, snapshots checked), confirming CARGO_FEATURE_MICROVM
  propagates via nanvix_binaries/microvm.
• cargo tree: nanvix_binaries absent on a default build, present with
  --features microvm.
• Reproduced the original parse failure against the exact non-UTF-8 byte
  sequence from the issue; the new parser extracts the correct hash instead of
  panicking.
• cargo fmt --all -- --check and cargo clippy -- -D warnings clean on the
  touched crates.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Fixes a Windows locale-dependent build-script panic and prevents the NanVix binary download/certutil checksum step from running unless the MicroVM backend is actually being built.

Changes:

• Made nanvix_binaries’ certutil SHA256 parsing resilient to non-UTF-8 localized output by using lossy decoding and scanning for the 64-hex digest line.
• Added a microvm feature to nanvix_binaries and gated the build script’s expensive download/verification work behind CARGO_FEATURE_MICROVM.
• Updated wxc and lxc feature wiring to enable nanvix_binaries’ new microvm feature when building with --features microvm.

Show a summary per file

File	Description
src/core/wxc/Cargo.toml	Adjusts the microvm feature to propagate nanvix_binaries’ new microvm feature.
src/core/lxc/Cargo.toml	Same as wxc: ensures MicroVM builds propagate the dependency feature.
src/backends/nanvix/binaries/Cargo.toml	Introduces a microvm feature to gate expensive build-script work.
src/backends/nanvix/binaries/build.rs	Adds feature gating to skip downloads by default and makes certutil output parsing locale-robust.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 3

[MGudgin]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).