flake: wrap the host in a separate symlinkJoin, so crane's toolchain reference removal keeps cargo on the wrapper PATH

flake.nix

@@ -143,14 +143,19 @@
           # The upstream browser fixture links to an optional, unbuilt artifact.
           dontCheckForBrokenSymlinks = true;
         });
-        sausage = craneLib.buildPackage (common // {
+        sausageUnwrapped = craneLib.buildPackage (common // {
           inherit cargoArtifacts;
           # Deno loads extension TypeScript from the vendored sources at runtime.
           doNotRemoveReferencesToVendorDir = true;
           cargoExtraArgs = "--locked -p sausage";
           doCheck = false;
-          nativeBuildInputs = common.nativeBuildInputs ++ [ pkgs.makeWrapper ];
-          postInstall = ''
+        });
+        # A separate wrapper, so that crane's toolchain reference removal cannot rewrite its PATH.
+        sausage = pkgs.symlinkJoin {
+          name = "sausage-${sausageUnwrapped.version}";
+          paths = [ sausageUnwrapped ];
+          nativeBuildInputs = [ pkgs.makeWrapper ];
+          postBuild = ''
             wrapProgram $out/bin/sausage --set-default SAUSAGE_USERLAND ${userland} \
               --prefix PATH : ${runtimePath} \
               --set-default CC_wasm32_wasip2 ${wasiCcEnv.CC_wasm32_wasip2} \
@@ -158,7 +163,7 @@
               ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux "--set-default ${moldVar} '-C link-arg=-fuse-ld=mold'"}
           '';
           meta.mainProgram = "sausage";
-        });
+        };
       in {
         packages.default = sausage;
         checks.package = sausage;