cut: the pin stage compiles, and zig build test builds the cut binary

Two errors the test build never saw, because the test binary analyses only what the tests reference: `Io.Dir.makePath` does not exist in 0.16.0 (`createDirPath` does), and the tag push passed the optional authorization where the checked token was meant. The test step now depends on the cut compile as well.

build.zig

@@ -316,6 +316,10 @@ pub fn build(b: *std.Build) void {
     // disk, so the test binary has to run at the build root.
     cut_tests_run.setCwd(b.path("."));
     test_step.dependOn(&cut_tests_run.step);
+    // The test binary analyses only what the tests reference; `main` and the
+    // stages behind it are compiled here so a type error in the cut itself
+    // fails `zig build test` and not the release.
+    test_step.dependOn(&cut_tool.step);
 
     // `dist_stage` owns the release archive bytes, and its reproducibility is
     // the property the flake pins depend on, so it is tested like any other