CI: fix configure breakage — set helgrind history via make CLI var, not Makefile.am

The previous commit added `VALGRIND_helgrind_FLAGS = --history-level=full`
right after @VALGRIND_CHECK_RULES@ in test/Makefile.am. That corrupted the
generated test/Makefile (config.status "am--depfiles" step hit a "missing
separator" at the injected region), so `configure` failed on every platform
with "Something went wrong bootstrapping makefile fragments". Reproduced and
confirmed fixed locally.

Revert the Makefile.am edit and instead pass VALGRIND_helgrind_FLAGS on the
`make check-valgrind-<tool>` command line in verify-build.yml. A make
command-line assignment overrides the macro's ?= default and propagates to
the recursive check-TESTS make, with none of the Makefile.in-generation risk;
it is inert for the memcheck/drd tools that don't consume it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NpysYDDJac63yz2mZKKiDf

Author: etr

.github/workflows/verify-build.yml

@@ -1394,7 +1394,19 @@ jobs:
       run: |
         cd build ;
         TOOL="${BUILD_TYPE#valgrind-}" ;
-        make "check-valgrind-${TOOL}" ;
+        # Override ax_valgrind_check's --history-level=approx default for
+        # helgrind. approx drops the happens-before history, so helgrind can't
+        # see the synchronisation MHD_start_daemon()'s pthread_create
+        # establishes between the main thread's pre-start setup and the worker
+        # threads reading that immutable-after-start state during dispatch,
+        # producing a flood of benign "data race" reports on libhttpserver
+        # frames whose conflicting access was "the start of the thread". full
+        # tracks the complete graph and proves those reads ordered, removing
+        # the false positives at the source (no libhttpserver-frame suppression,
+        # per DR-008). A make command-line assignment overrides the Makefile's
+        # ?= default and propagates to the recursive check-TESTS make; it is
+        # inert for the memcheck/drd tools that don't consume it.
+        make VALGRIND_helgrind_FLAGS=--history-level=full "check-valgrind-${TOOL}" ;
       if: ${{ startsWith(matrix.build-type, 'valgrind-') }}
 
     - name: Print Valgrind results

test/Makefile.am

@@ -689,19 +689,6 @@ TESTS = $(check_PROGRAMS)
 # removed when the umbrella went clean.)
 
 @VALGRIND_CHECK_RULES@
-# Override the ax_valgrind_check default (--history-level=approx). `approx`
-# drops the full happens-before history, so helgrind cannot see the
-# synchronisation that MHD_start_daemon()'s pthread_create establishes
-# between the main thread's pre-start setup and the worker threads that read
-# that (immutable-after-start) state during dispatch. That produced a flood
-# of benign "data race" reports on libhttpserver frames (resolve_method_callback,
-# get_allowed_methods, method_set::contains, webserver::get_bound_port, ...)
-# whose conflicting access was literally "the start of the thread". `full`
-# tracks the complete happens-before graph and correctly proves those reads
-# are ordered after setup, eliminating the false positives at the source.
-# This assignment follows @VALGRIND_CHECK_RULES@, so it wins over the macro's
-# conditional (?=) default.
-VALGRIND_helgrind_FLAGS = --history-level=full
 # TASK-088: helgrind + drd race-detector suppression files join the shared
 # VALGRIND_SUPPRESSIONS_FILES list. Suppression blocks are tool-tagged
 # (Memcheck:/Helgrind:/drd:), so each tool ignores blocks meant for another;