Fixes #20.

Problem

ci/build-runner.sh built arm64 natively on rust:1.95-trixie (glibc 2.39) and cross-linked amd64 with trixie’s gnu-gcc, baking a GLIBC_2.39 floor into the published binaries. They then fail to load on older runtimes — every release job on a Debian 12 / glibc 2.36 runner dies with libc.so.6: version \GLIBC_2.39’ not found. (Same failure on every consumer of /runner/download`.)

Fix

Build both targets with cargo-zigbuild pinned to a gnu.2.31 floor (covers Debian 11+, Ubuntu 20.04+, RHEL 9). The easy case for zigbuild here: TLS is rustls + ring (no openssl/aws-lc-rs), build.rs compiles no C. zig cc cross-links amd64, so the gcc-x86-64-linux-gnu cross-compiler is dropped (xz-utils added for the zig tarball). zig + cargo-zigbuild versions pinned together.

Regression gate

Build now fails if either binary references a GLIBC symbol above 2.31 (grepped from the dynamic string table — no binutils needed), so the floor can’t silently creep back up on a future dep/toolchain bump.

Validation

bash -n + shellcheck clean; floor-comparison logic unit-checked locally. End-to-end zigbuild + the floor gate run in this branch’s CI (the build-runner step builds + verifies on non-main, skipping only publish).

🤖 Generated with Claude Code