fix(ci): scope conan_deps_cxxflags per Conan package pattern

prior shape (bare json list -> 'tools.build:cxxflags=[...]') leaked into
the consumer/rippled build via the conan-generated toolchain
(CMAKE_CXX_FLAGS_INIT). on macOS, where the build action doesn't
override CMAKE_CXX_FLAGS, this would silently apply the workaround flag
to rippled itself.

reshape the input to a json object keyed by Conan package pattern:
  {"grpc/*":["-Wno-..."]}

action emits package-pattern scoped lines:
  grpc/*:tools.build:cxxflags=["-Wno-..."]

flags only apply while building the matching dependency. consumer
toolchain stays clean. python validator rejects the consumer pattern
('&') and malformed shapes.

.github/actions/xahau-ga-dependencies/action.yml

@@ -51,9 +51,9 @@ inputs:
       - libstdcxx
       - libcxx
   conan_deps_cxxflags:
-    description: 'Extra cxxflags applied to Conan dependency builds only (NOT the rippled build). JSON list, e.g. ["-Wno-foo","-Wno-bar"]. Maps to Conan tools.build:cxxflags.'
+    description: 'Extra cxxflags applied to Conan dependency package builds only (NOT the rippled build). JSON object keyed by Conan package pattern, e.g. {"grpc/*":["-Wno-foo"]}. Maps to <pattern>:tools.build:cxxflags.'
     required: false
-    default: '[]'
+    default: '{}'
 
 outputs:
   cache-hit:
@@ -85,6 +85,8 @@ runs:
 
     - name: Configure Conan
       shell: bash
+      env:
+        CONAN_DEPS_CXXFLAGS: ${{ inputs.conan_deps_cxxflags }}
       run: |
         # Create the default profile directory if it doesn't exist
         mkdir -p ~/.conan2/profiles
@@ -111,9 +113,11 @@ runs:
 
         # [buildenv] + [conf] sections.
         # Linux pins compiler executables; macOS uses the system toolchain.
-        # conan_deps_cxxflags (matrix-driven) optionally adds tools.build:cxxflags
-        # for Conan dependency builds only - typically grpc workarounds for
-        # newer clang's stricter diagnostics. Does NOT affect the rippled build.
+        # conan_deps_cxxflags (matrix-driven) optionally adds package-pattern
+        # scoped tools.build:cxxflags for Conan dependency builds only - typically
+        # grpc workarounds for newer clang's stricter diagnostics. Because these
+        # are profile-pattern scoped (e.g. grpc/*:...), they do NOT affect the
+        # consumer/rippled toolchain generated for the main build.
         NEED_CONF=0
         if [ "${{ inputs.os }}" = "Linux" ] && [ -n "${{ inputs.cc }}" ]; then
           cat >> ~/.conan2/profiles/default <<EOF
@@ -128,12 +132,35 @@ runs:
           NEED_CONF=1
         fi
 
-        if [ "${{ inputs.conan_deps_cxxflags }}" != "[]" ] && [ -n "${{ inputs.conan_deps_cxxflags }}" ]; then
-          if [ "$NEED_CONF" = "0" ]; then
+        if [ -n "${CONAN_DEPS_CXXFLAGS}" ] && [ "${CONAN_DEPS_CXXFLAGS}" != "{}" ]; then
+          CONAN_DEPS_CXXFLAGS_LINES="$(python3 - <<'PY'
+        import json
+        import os
+        import sys
+
+        raw = os.environ["CONAN_DEPS_CXXFLAGS"]
+        data = json.loads(raw)
+        if not isinstance(data, dict):
+            sys.exit("conan_deps_cxxflags must be a JSON object like {\"grpc/*\": [\"-Wno-...\"]}")
+
+        for pattern, flags in data.items():
+            if not isinstance(pattern, str) or not pattern:
+                sys.exit("conan_deps_cxxflags keys must be non-empty Conan package patterns")
+            if pattern == "&":
+                sys.exit("conan_deps_cxxflags must target dependency package patterns, not the consumer (&)")
+            if not isinstance(flags, list) or not all(isinstance(flag, str) for flag in flags):
+                sys.exit(f"{pattern}: cxxflags must be a JSON string list")
+            if flags:
+                print(f"{pattern}:tools.build:cxxflags={json.dumps(flags, separators=(',', ':'))}")
+        PY
+          )"
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ] && [ "$NEED_CONF" = "0" ]; then
             echo "" >> ~/.conan2/profiles/default
             echo "[conf]" >> ~/.conan2/profiles/default
           fi
-          echo 'tools.build:cxxflags=${{ inputs.conan_deps_cxxflags }}' >> ~/.conan2/profiles/default
+          if [ -n "${CONAN_DEPS_CXXFLAGS_LINES}" ]; then
+            printf '%s\n' "${CONAN_DEPS_CXXFLAGS_LINES}" >> ~/.conan2/profiles/default
+          fi
         fi
 
         # Display profile for verification

.github/workflows/xahau-ga-macos.yml

@@ -109,7 +109,7 @@ jobs:
           stdlib: libcxx
           # grpc 1.50.1 trips clang-19+ -Werror=missing-template-arg-list-after-template-kw
           # on Apple Clang. Drop when grpc is bumped past the fix.
-          conan_deps_cxxflags: '["-Wno-missing-template-arg-list-after-template-kw"]'
+          conan_deps_cxxflags: '{"grpc/*":["-Wno-missing-template-arg-list-after-template-kw"]}'
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build

.github/workflows/xahau-ga-nix.yml

@@ -89,7 +89,9 @@ jobs:
                   # grpc 1.50.1 uses `Foo::template Bar(...)` without an
                   # angle-bracket arg list; clang-19+ promoted that to
                   # -Werror. Drop when grpc is bumped past the fix.
-                  "conan_deps_cxxflags": ["-Wno-missing-template-arg-list-after-template-kw"]
+                  "conan_deps_cxxflags": {
+                      "grpc/*": ["-Wno-missing-template-arg-list-after-template-kw"]
+                  }
               },
               {
                   "compiler_id": "clang-14-libstdcxx-gcc11",
@@ -411,7 +413,7 @@ jobs:
           cc: ${{ matrix.cc }}
           cxx: ${{ matrix.cxx }}
           stdlib: ${{ matrix.stdlib }}
-          conan_deps_cxxflags: ${{ matrix.conan_deps_cxxflags && toJson(matrix.conan_deps_cxxflags) || '[]' }}
+          conan_deps_cxxflags: ${{ matrix.conan_deps_cxxflags && toJson(matrix.conan_deps_cxxflags) || '{}' }}
           gha_cache_enabled: 'false' # Disable caching for self hosted runner
 
       - name: Build