cut: the pin stage compiles, and zig build test builds the cut binary

Two errors the test build never saw, because the test binary analyses only what the tests reference: `Io.Dir.makePath` does not exist in 0.16.0 (`createDirPath` does), and the tag push passed the optional authorization where the checked token was meant. The test step now depends on the cut compile as well.

build.zig

@@ -316,6 +316,10 @@ pub fn build(b: *std.Build) void {
     // disk, so the test binary has to run at the build root.
     cut_tests_run.setCwd(b.path("."));
     test_step.dependOn(&cut_tests_run.step);
+    // The test binary analyses only what the tests reference; `main` and the
+    // stages behind it are compiled here so a type error in the cut itself
+    // fails `zig build test` and not the release.
+    test_step.dependOn(&cut_tool.step);
 
     // `dist_stage` owns the release archive bytes, and its reproducibility is
     // the property the flake pins depend on, so it is tested like any other

tools/cut.zig

@@ -1671,7 +1671,7 @@ fn pinStage(ctx: *Ctx, version: []const u8, environ: *const std.process.Environ.
         ctx.soft("pin", "cannot clear the build cache at {s}: {t}", .{ scratch_root, err });
         return CheckFailed;
     };
-    Io.Dir.cwd().makePath(ctx.io, scratch_root) catch |err| {
+    Io.Dir.cwd().createDirPath(ctx.io, scratch_root) catch |err| {
         ctx.soft("pin", "cannot create the build cache at {s}: {t}", .{ scratch_root, err });
         return CheckFailed;
     };
@@ -2188,7 +2188,7 @@ fn cut(ctx: *Ctx, kind_text: []const u8) !void {
 
     const release_floor = try pushAndFloor(ctx, "push-tag", &.{
         "git", "push", "--porcelain", "origin", tag,
-    }, tag_ref, try runIdFloor(ctx, authorization));
+    }, tag_ref, try runIdFloor(ctx, token));
     // A tag that was already on origin is refused in the preflight, so this
     // push cannot legitimately be a no-op.
     if (release_floor == null) {