Symptom

The release CI job (and every consumer of /runner/download) fails on Debian 12 runners:

/usr/local/bin/anvil: /lib/aarch64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found (required by /usr/local/bin/anvil)

Cause

ci/build-runner.sh builds arm64 natively on the rust:1.95-trixie image (glibc 2.39) and cross-builds amd64 with trixie’s gnu-gcc, so both binaries bake a GLIBC_2.39 floor. They then can’t load on older runtimes (Debian 12 bookworm / glibc 2.36, Ubuntu 22.04 / 2.35, etc.).

Fix

Build both targets with cargo-zigbuild pinned to a gnu.2.31 glibc floor (covers Debian 11+, Ubuntu 20.04+, RHEL 9). Build is the easy case for zigbuild: TLS is rustls + ring (no openssl/aws-lc-rs), build.rs compiles no C. As a bonus, zig cc cross-links amd64, so the separate gcc-x86-64-linux-gnu cross-linker can be dropped. Add a CI assertion that the built binaries’ max GLIBC symbol is <= 2.31 so this can’t silently regress.