Creating a MinGW reproducible build job would ensure we don't regress reproducibility for Tor Browser. (Or if we do regress it, we identify it immediately where and when.)

New try run

Looked briefly, and can explain one of the differences:

In the .exe's there's a guid that appears right before a "LLD PDB" string. This is the guid of the pdb file.
It also appears in the same place/way in the pdb file.
It is generated from a hash of the pdb file; so once the pdb file is otherwise identical it should also be identical.
https://github.com/llvm/llvm-project/search?q=setHashPDBContentsToGUID&unscoped_q=setHashPDBContentsToGUID
https://github.com/llvm/llvm-project/blob/adcd02683856c30ba6f349279509acecd90063df/llvm/lib/DebugInfo/PDB/Native/PDBFileBuilder.cpp#L333-L348
https://github.com/llvm/llvm-project/blob/a39b14f0b42d6bd835dec448506660d77bbbb7c7/lld/COFF/PDB.cpp#L1739