ci: strip nim/nimble from lock before nimble setup

Restores a fix that was dropped in e5b46e5e and re-exposed when cda01971
reintroduced nim/nimble into nimble.lock: the nim package never matches
its Linux-computed checksum on Windows because nim's own .gitattributes
forces line endings on parts of its tree, so the SHA1 differs regardless
of core.autocrlf. autocrlf alone therefore cannot fix the nim mismatch.

Remove nim/nimble from the lock before `nimble setup` (they are provided
by the toolchain installed in CI, not real project deps). Added to the
Windows workflow, which never had it, and restored in ci.yml's setup
steps since the cache-key bump now forces those to run on a fresh tree.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -94,6 +94,17 @@ jobs:
       - name: Install nimble deps
         if: steps.cache-nimbledeps.outputs.cache-hit != 'true'
         run: |
+          # nim and nimble have unstable cross-platform checksums (their source
+          # trees check out differently per OS), so strip them from the lock
+          # before setup to avoid spurious mismatches; the toolchain installed
+          # above provides them, they are not resolved as project deps.
+          python3 -c "
+          import json
+          lock = json.load(open('nimble.lock'))
+          for key in ['nim', 'nimble']:
+            lock['packages'].pop(key, None)
+          json.dump(lock, open('nimble.lock', 'w'), indent=2)
+          "
           nimble setup --localdeps -y
           make rebuild-nat-libs-nimbledeps
           make rebuild-bearssl-nimbledeps
@@ -147,6 +158,17 @@ jobs:
       - name: Install nimble deps
         if: steps.cache-nimbledeps.outputs.cache-hit != 'true'
         run: |
+          # nim and nimble have unstable cross-platform checksums (their source
+          # trees check out differently per OS), so strip them from the lock
+          # before setup to avoid spurious mismatches; the toolchain installed
+          # above provides them, they are not resolved as project deps.
+          python3 -c "
+          import json
+          lock = json.load(open('nimble.lock'))
+          for key in ['nim', 'nimble']:
+            lock['packages'].pop(key, None)
+          json.dump(lock, open('nimble.lock', 'w'), indent=2)
+          "
           nimble setup --localdeps -y
           make rebuild-nat-libs-nimbledeps
           make rebuild-bearssl-nimbledeps
@@ -212,6 +234,17 @@ jobs:
       - name: Install nimble deps
         if: steps.cache-nimbledeps.outputs.cache-hit != 'true'
         run: |
+          # nim and nimble have unstable cross-platform checksums (their source
+          # trees check out differently per OS), so strip them from the lock
+          # before setup to avoid spurious mismatches; the toolchain installed
+          # above provides them, they are not resolved as project deps.
+          python3 -c "
+          import json
+          lock = json.load(open('nimble.lock'))
+          for key in ['nim', 'nimble']:
+            lock['packages'].pop(key, None)
+          json.dump(lock, open('nimble.lock', 'w'), indent=2)
+          "
           nimble setup --localdeps -y
           make rebuild-nat-libs-nimbledeps
           make rebuild-bearssl-nimbledeps

.github/workflows/windows-build.yml

@@ -109,6 +109,19 @@ jobs:
       if: steps.cache-nimbledeps.outputs.cache-hit != 'true'
       run: |
         export PATH="$GITHUB_WORKSPACE/.nim_runtime/bin:$HOME/.nimble/bin:$PATH"
+        # nim and nimble have unstable cross-platform checksums: their source
+        # trees check out differently per OS (nim ships a .gitattributes that
+        # forces line endings on some files), so their SHA1 never matches the
+        # Linux-computed values in nimble.lock on Windows — even with autocrlf
+        # disabled. Strip them from the lock before setup; they are provided by
+        # the toolchain installed above, not resolved as project deps.
+        python -c "
+        import json
+        lock = json.load(open('nimble.lock'))
+        for key in ['nim', 'nimble']:
+          lock['packages'].pop(key, None)
+        json.dump(lock, open('nimble.lock', 'w'), indent=2)
+        "
         nimble setup --localdeps -y
         make rebuild-nat-libs-nimbledeps CC=gcc
         make rebuild-bearssl-nimbledeps CC=gcc