fix(windows): append SSE flags as a pure-CMake block to xwin toolchain

The previous sed-based patch didn't stick in the docker-bash-c
heredoc (bash single-quoting made the newline escaping fragile).
Switch to a much simpler approach: just 'cat >>' a pure-CMake block
to the end of the cargo-xwin toolchain file. The block does:

    set(CMAKE_C_FLAGS   "${CMAKE_C_FLAGS}   /clang:-msse4.1 ..." CACHE STRING "" FORCE)
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /clang:-msse4.1 ..." CACHE STRING "" FORCE)

Running AFTER the toolchain's own FORCE-set and AFTER cmake-rs's
-DCMAKE_C_FLAGS= command-line override, it unconditionally wins. No
sed, no awk, no python, no newline escaping — just CMake reading the
toolchain file like it normally does.

Idempotent via the WZP_SSE_PATCH sentinel grep in the comment block.

scripts/build-windows-docker.sh

@@ -192,10 +192,31 @@ set -euo pipefail
 # the closing paren of the COMPILE_FLAGS setter. Idempotent across
 # runs — if the file already contains the sentinel line we skip.
 TOOLCHAIN_FILE=/home/builder/.cache/cargo-xwin/cmake/clang-cl/x86_64-pc-windows-msvc-toolchain.cmake
-if ! grep -q "WZP_SSE_PATCH" "$TOOLCHAIN_FILE"; then
-    echo ">>> Patching cargo-xwin toolchain for SSE4.1 / SSSE3 intrinsics"
-    sed -i "s|/imsvc /home/builder/.cache/cargo-xwin/xwin/sdk/include/winrt)|/imsvc /home/builder/.cache/cargo-xwin/xwin/sdk/include/winrt\\n    # WZP_SSE_PATCH — enable SSE4.1/SSSE3 so libopus (audiopus_sys) builds\\n    /clang:-msse4.1\\n    /clang:-mssse3\\n    /clang:-msse3\\n    /clang:-msse2)|" "$TOOLCHAIN_FILE"
+echo ">>> Patching cargo-xwin toolchain for SSE4.1 / SSSE3 intrinsics"
+if grep -q WZP_SSE_PATCH "$TOOLCHAIN_FILE"; then
+    echo "    (already patched, skipping)"
+else
+    # The cleanest way to add flags is to append a pure-CMake block to
+    # the end of the toolchain file. Both CMAKE_C_FLAGS and
+    # CMAKE_CXX_FLAGS were already FORCE-set earlier in the toolchain;
+    # we override them again with the same content plus our SSE flags.
+    # This runs AFTER the original set(... FORCE) and the CMAKE_ARGS
+    # from the cmake-rs invocation, so it wins.
+    cat >> "$TOOLCHAIN_FILE" <<CMAKE_PATCH_EOF
+
+# ── WZP_SSE_PATCH ─────────────────────────────────────────────────────────
+# libopus (audiopus_sys) has per-file COMPILE_FLAGS "-msse4.1" on its
+# sse4_1.c sources, which clang-cl silently drops (expects /clang:-m…).
+# Force-add the flags globally so every C file in the opus cmake subbuild
+# compiles with the intrinsics target features enabled. All x86_64
+# Windows CPUs shipped since 2008 support these, so enabling them
+# globally on this target is safe.
+set(CMAKE_C_FLAGS   "\${CMAKE_C_FLAGS}   /clang:-msse4.1 /clang:-mssse3 /clang:-msse3 /clang:-msse2" CACHE STRING "" FORCE)
+set(CMAKE_CXX_FLAGS "\${CMAKE_CXX_FLAGS} /clang:-msse4.1 /clang:-mssse3 /clang:-msse3 /clang:-msse2" CACHE STRING "" FORCE)
+CMAKE_PATCH_EOF
 fi
+echo ">>> Toolchain tail after patch:"
+tail -15 "$TOOLCHAIN_FILE"
 
 cd /build/source/desktop