gh-134291: Add unguarded-availability check to JIT builds

Author: zanieb

.github/workflows/jit.yml

@@ -113,6 +113,7 @@ jobs:
           find /usr/local/bin -lname '*/Library/Frameworks/Python.framework/*' -delete
           brew install llvm@${{ matrix.llvm }}
           export SDKROOT="$(xcrun --show-sdk-path)"
+          export MACOSX_DEPLOYMENT_TARGET=10.15
           ./configure --enable-experimental-jit --enable-universalsdk --with-universal-archs=universal2 ${{ matrix.debug && '--with-pydebug' || '' }}
           make all --jobs 4
           ./python.exe -m test --multiprocess 0 --timeout 4500 --verbose2 --verbose3

Tools/jit/_targets.py

@@ -149,6 +149,8 @@ async def _compile(
             "-fno-plt",
             # Don't call stack-smashing canaries that we can't find or patch:
             "-fno-stack-protector",
+            # Error if symbols above the deployment target without guards
+            "-Werror=unguarded-availability",
             "-std=c11",
             "-o",
             f"{o}",