[codex] Build Linux release artifacts for generic CPU targets

[Jesssullivan]

Summary

Makes Linux release artifacts build for generic Linux CPU targets instead of the native runner CPU, and tightens the distro VM smoke test so crashing binaries cannot pass.

Why

Release proof 25081237436 showed two separate problems:

• Rocky 10 repo bootstrap still had a sed delimiter bug from PR [codex] Fix Rocky 10 distro VM repository bootstrap #271.
• Fedora VM validation installed the RPM but both cmux --version and cmux --help trapped with Illegal instruction. The current smoke test masked that with || echo 'binary runs', so validation continued instead of failing at the real runtime issue.

The illegal-instruction trace strongly points at native-runner CPU feature leakage in release builds. The release workflow was building all Zig components without -Dtarget, which lets Zig optimize for the native builder CPU. That is not acceptable for distro artifacts expected to run inside older or more constrained VM/user CPUs.

Changes

• Add generic Zig target triples to each Linux release matrix:
  • x86_64-linux-gnu
  • aarch64-linux-gnu
• Pass the matrix target to release builds for vendor Zig libs, libghostty, cmux-linux, and cmuxd.
• Tighten distro VM binary smoke check to require cmux --version or cmux --help to actually succeed.
• Fix the Rocky 10.1 repo rewrite sed expression by switching to a delimiter that does not conflict with the regex alternative.

Validation

• nix-instantiate --parse nix/tests-distro.nix
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release-linux.yml"); puts "release-linux.yml parses"'
• git diff --check

actionlint is not installed locally, so full workflow validation will come from GitHub Actions.

[greptile-apps]

Greptile Summary

This PR fixes two root-cause issues from release proof 25081237436: (1) native runner CPU feature leakage in Zig release builds causing Illegal instruction on target VMs, addressed by adding a zig field to every matrix entry and passing -Dtarget to all Zig build invocations across all three jobs; (2) a smoke test that masked binary crashes via || echo 'binary runs', now tightened to require either cmux --version or cmux --help to actually exit 0. A Rocky 10.1 sed delimiter collision is also fixed.

Confidence Score: 4/5

This PR is safe to merge; changes are straightforward, consistently applied, and directly address confirmed release failures.

No P0 or P1 issues found. The Zig target pinning is applied uniformly across all three jobs and all build steps. The smoke-test tightening correctly removes the fallback that hid real crashes. The sed delimiter fix is accurate. Score of 4 rather than 5 because actionlint validation is explicitly deferred to CI (noted in the PR description), so full workflow correctness is still pending runner execution.

No files require special attention beyond confirming CI passes with the new -Dtarget flags.

Important Files Changed

Filename	Overview
.github/workflows/release-linux.yml	Adds zig: x86_64-linux-gnu / aarch64-linux-gnu to all three release matrix jobs and threads -Dtarget=${{ matrix.arch.zig }} through every zig build invocation; change is applied consistently across build-deb and both RPM jobs.
nix/tests-distro.nix	Removes the `

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Release trigger / workflow_dispatch] --> B{Matrix arch}
    B -->|amd64 / x86_64| C["runner: ubuntu-latest\nzig: x86_64-linux-gnu"]
    B -->|arm64 / aarch64| D["runner: ubuntu-24.04-arm\nzig: aarch64-linux-gnu"]

    C --> E["zig build -Dtarget=x86_64-linux-gnu\n(vendor libs, libghostty,\ncmux-linux, cmuxd)"]
    D --> F["zig build -Dtarget=aarch64-linux-gnu\n(vendor libs, libghostty,\ncmux-linux, cmuxd)"]

    E --> G[Assemble DEB / RPM package]
    F --> G

    G --> H[VM smoke test]
    H --> I{"cmux --version 2>&1\n|| cmux --help 2>&1"}
    I -->|exit 0| J[✅ Pass]
    I -->|non-zero| K[❌ Fail — illegal instruction caught]

Loading

_{Reviews (1): Last reviewed commit: "Build Linux release artifacts for generi..." | Re-trigger Greptile}