macOS: sed -i portability blocks build (Makefile + nistcurves p384 staging)

[JC-000]

macOS build aborts on sed -i calls in Makefile + tools/integration/

Symptom

Building on macOS sequoia (BSD sed) fails on the very first sed -i invocation with errors like:

sed: 1: "<file>": undefined label '<file>'

…or silently uses the file argument as the backup-suffix and corrupts the source tree, depending on which call fires first. GNU sed (Linux default) is happy with sed -i '<expr>' file; BSD sed (macOS default) requires sed -i '' '<expr>' file (explicit empty backup-suffix argument).

Affected files

tools/integration/build_nistcurves_p256.sh was already updated to use sed -i ''. Twelve more sites across three files still use the GNU-only form:

File	Sites
Makefile:112	1 (label rewrite during PRG link)
tools/integration/build_nistcurves_p384.sh	10 (lines 115-123, 231-233)
tools/integration/build_nistcurves_p384_bin.sh:133	1 (label rewrite)

Fix

Convert each call site to the BSD-portable form sed -i '' '<expr>' file. GNU sed accepts the empty-string suffix argument as a no-op, so the change preserves Linux compatibility.

Out of scope (already resolved upstream)

While diagnosing this, I also looked at two other macOS-portability issues I had hit historically against c64-https@6c9d2a3 (Phase C.1):

1. tools/integration/build_x25519.sh had 7× sed -i sites — the script no longer exists on master after the Phase C.1 rollback, so this is moot.
2. tools/uci/test_https_local.py:_load_labels() used to crash on REU-overlay-bank label lines (no : in parts[1]). Master has replaced the inline parser with Labels.from_file() (c64-test-harness ≥0.12.4), which handles both C: and bank-prefixed forms — also moot.

A PR for the remaining 12 sites is incoming.

[JC-000]

Superseded by #33, which lands the Makefile + build_nistcurves_p256.sh fix.

Remaining work not in #33 — 11 sed -i sites in the p384 staging scripts that still use the GNU-only form:

• tools/integration/build_nistcurves_p384.sh — 10 sites (lines 115-123, 231-233)
• tools/integration/build_nistcurves_p384_bin.sh:133 — 1 site

Recommend either (a) extending #33 with these or (b) a follow-up PR after #33 lands. Closing this issue as the high-priority Makefile fix is covered.

Note for the reviewer: I also tried to push a fix branch (now deleted) but caught it leaking — its base contained 8d1dfa5 chore(hooks): add client-side email-enforcement hooks whose blob content includes the banned strings literally as enforcement-regex patterns (5 hits across .githooks/README.md and .githooks/commit-msg). After the in-progress scrub-replay the hooks commit is no longer reachable from origin. Just flagging in case it's relevant for any future hook-style rollouts: client-side enforcement hooks must live machine-scope (new-computer-setup), never as committed blobs in this repo.