ci(release): build Linux targets with cargo-zigbuild (glibc 2.28, real musl C++ runtime)

[devin-ai-integration]

Summary

Fixes two bugs in the v1.4.0 Linux release binaries (workflow-only change, no release is triggered by this PR):

1. vera-x86_64-unknown-linux-gnu / aarch64 require GLIBC 2.39. They were linked natively on Ubuntu 24.04 runners, so they fail with GLIBC_2.39 not found on Ubuntu 22.04, Debian 12, RHEL 9, etc.
2. vera-x86_64-unknown-linux-musl segfaults in tree_sitter_sql_external_scanner_create on any repo containing a .sql file. The old step set CXX_x86_64_unknown_linux_musl=g++ (host glibc g++), so the only C++ scanner was compiled against glibc libstdc++ and linked into a static musl binary.

Both Linux gnu targets and the musl target now build with cargo zigbuild (matrix.zig: true), which provides a self-contained C/C++ toolchain:

x86_64-unknown-linux-gnu   -> cargo zigbuild --target x86_64-unknown-linux-gnu.2.28
aarch64-unknown-linux-gnu  -> cargo zigbuild --target aarch64-unknown-linux-gnu.2.28
x86_64-unknown-linux-musl  -> cargo zigbuild --target x86_64-unknown-linux-musl   (zig's musl libc++)

ort is load-dynamic, so there is no link-time ONNX Runtime dependency to cross-link. The musl-tools / g++ symlink hack is removed; the sqlite-vec u_intN_t CFLAGS are kept. A new Check Linux binary portability step fails the build if the gnu binary's highest GLIBC_x.y symbol exceeds the matrix glibc floor, or if the musl binary is not static. macOS/Windows steps are unchanged (Build (native) now guarded by !matrix.zig).

Verified locally with the exact workflow commands (cargo-zigbuild 0.23.4 / zig 0.16):

• gnu.2.28 binary: objdump -T max symbol GLIBC_2.28, --version runs, setup --potion-code --index . on Flask exits 0.
• musl binary: statically linked; setup --potion-code --index . on Flask with a .sql file present exits 0 (previously segfaulted), search exits 0.

Only the workflow is changed; a v1.4.1 tag would be needed to ship fixed binaries.

Link to Devin session: https://app.devin.ai/sessions/0b10c0b095784568acf302cc024ef089
Open in Devin Desktop: https://app.devin.ai/desktop/session/0b10c0b095784568acf302cc024ef089?variant=devin
Requested by: @lemon07r

---

Summary by cubic

Fixes the v1.4.0 Linux release binaries: GNU builds now link against glibc 2.28 instead of the runner's 2.39, and the musl build gets a real musl C++ runtime so it no longer segfaults on repos with SQL files.

Changes

• Switches all three Linux targets to cargo-zigbuild via the matrix zig: true flag.
• Removes the musl-tools and g++ symlink hack; keeps the sqlite-vec u_intN_t CFLAGS.
• Adds a portability check that fails if GNU binaries exceed the glibc floor or musl is not static.
• Verified locally: GNU binary shows max GLIBC_2.28, musl binary is static and handles .sql files without crashing.
• Only the workflow file changes; a v1.4.1 tag is needed to ship the fixed binaries.

^{Written for commit 86816ac. Summary will update on new commits.}

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.