Fix portable static Linux release artifacts

[regenrek]

Summary

• build the public x86_64 and arm64 Linux artifacts as static musl binaries on native GitHub runners in a digest-pinned Rust 1.90.0 Alpine image
• block release upload until each extracted tarball passes embedded checksum, static ELF/no-GLIBC, older Alpine 3.20.8 lifecycle, and exact npm-byte/wrapper verification
• add the same no-secret two-architecture portability gate to pull-request CI, including aggregate candidate checksums
• make the workflow verifier reject GNU release targets, same-runner-only smoke tests, missing/late compatibility gates, mutable images, incomplete ELF/lifecycle/npm checks, and incomplete aggregate checksums
• document the static-musl Linux support contract and reproducible release evidence

Root cause

The v1.7.2 GNU Linux artifacts were built on Ubuntu 24.04 and require GLIBC_2.39; both public architectures fail on Debian Bookworm. The release workflow only executed --version on its build host, which proves architecture/executability on that host but not the documented Linux compatibility contract.

Verification

Local non-Linux verification is green:

• full scripts/ci-local.sh gate: 165 unit, 72 E2E, 11 eval-contract, 3 routing tests; fmt, clippy, contracts, release/npm/audit, and external-consumer checks
• workflow contract: 12 fail-closed adversarial cases
• full docs static/build/reference suite and live browser verification: 68 pages, 20 interactions, Axe on 23 pages with zero serious/critical findings
• BetterLeaks clean and Trivy zero vulnerabilities

The new native GitHub x86_64 and arm64 jobs are intentionally the deciding Linux build/runtime evidence. No Linux binary was built on macOS.

Scope

This PR does not publish or replace v1.7.2 assets, bump a version, create a tag, publish npm, remove the public eval API, or change the existing macOS release jobs.