fix: harden build against empty toolchain output

On some Windows systems, antivirus, endpoint-security or DLP/encryption
software intercepts short-lived toolchain processes and strips their
stdout when the build captures it through a pipe, while the same command
prints its output normally when run by hand. The tool exits successfully
but returns nothing, and each build step that reads toolchain output then
failed with a different, cryptic error far from the real cause:

- CMake configuration aborted with "Unknown arguments specified" in
  components/xtensa/project_include.cmake, or "check_expected_tool_version
  invoked with incorrect arguments" in components/esp_common.
- ldgen turned the empty objdump output into an opaque pyparsing
  "Expected 'In archive'" traceback.
- idf_tools.py silently reported the compiler/debugger version as
  "unknown", sending users into a fruitless reinstall loop.

Detect the empty result at each consumer and fail (or warn) with an
actionable message that names the likely cause and the remedy:

- tools/cmake/compiler_query.cmake: new __compiler_query() helper runs a
  compiler query and fails with a clear error on empty or failed output.
  It is a standalone module included by the build system utilities, so
  that it is available to the esp_common and xtensa project_include.cmake
  files that call it. The xtensa if() arguments are now quoted so an
  empty result no longer collapses into a parse error.
- tools/ldgen/ldgen.py: _run_objdump() rejects empty objdump output, and
  non-empty-but-unparsable section info is caught and re-raised as a clear
  LdGenFailure instead of a raw pyparsing traceback.
- tools/idf_tools.py: empty version output now warns with the cause and
  returns UNKNOWN_VERSION instead of silently reporting "unknown".

Closes https://github.com/espressif/esp-idf/issues/18727

Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>

tools/cmake/compiler_query.cmake

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Apache-2.0
+
+# __compiler_query
+#
+# Run a compiler query command (e.g. "<compiler> -dumpmachine") given in ARGN
+# and store its trimmed stdout in the variable named by "output_var".
+#
+# Fails with an actionable error if the command fails or returns no output. On
+# some Windows systems, antivirus, endpoint-security or DLP/encryption software
+# intercepts short-lived toolchain processes and strips their stdout when it is
+# captured by the build system, while the same command works when run directly
+# in a terminal. Without this guard the empty result collapses the callers'
+# parsing into a cryptic CMake error (see
+# https://github.com/espressif/esp-idf/issues/18727).
+#
+# This module is included by the build system utilities, so that
+# __compiler_query is available to the esp_common and xtensa
+# project_include.cmake files that call it.
+function(__compiler_query output_var)
+    execute_process(
+        COMMAND ${ARGN}
+        OUTPUT_VARIABLE query_output
+        RESULT_VARIABLE query_result
+        OUTPUT_STRIP_TRAILING_WHITESPACE)
+
+    if(NOT query_result EQUAL 0 OR query_output STREQUAL "")
+        string(REPLACE ";" " " query_command "${ARGN}")
+        message(FATAL_ERROR
+            "Failed to query the compiler: '${query_command}' (result: ${query_result}).\n"
+            "The command produced no output when run by the build system. This is usually caused "
+            "by antivirus, endpoint-security or DLP/encryption software intercepting the compiler "
+            "process and discarding its output; the same command often works when run directly in "
+            "a terminal.\n"
+            "Add an exclusion for the ESP-IDF tools directory in that software (on a managed "
+            "machine you may need your IT department), then run 'idf.py fullclean' and build again.")
+    endif()
+
+    set(${output_var} "${query_output}" PARENT_SCOPE)
+endfunction()