release.yml: arm64-static — give musl-gcc access to Linux uapi headers

Previous attempt failed with:
  modules/copy_fail_family/src/apparmor_bypass.c:23:10:
  fatal error: linux/capability.h: No such file or directory

musl-gcc points at musl's libc headers, which (correctly) don't
include Linux kernel uapi (linux/netfilter/*.h, linux/capability.h,
etc.). On Ubuntu these come from the linux-libc-dev package living
at /usr/include + /usr/include/aarch64-linux-gnu.

Fix: -isystem both paths so musl-gcc can find Linux uapi without
those paths shadowing musl's own libc decls (which they would if
we used a plain -I). The Alpine x86_64 build doesn't hit this
because Alpine's linux-headers package installs into musl's own
include path.

.github/workflows/release.yml

@@ -114,11 +114,15 @@ jobs:
               musl-tools musl-dev linux-libc-dev build-essential
       - name: build static (musl-gcc)
         run: |
-          # musl-gcc wraps gcc with musl's libc + headers. -static is
-          # the whole point — same MSG_COPY define as the x86_64
-          # build since musl lacks the SysV msg flag.
+          # musl-gcc wraps gcc with musl's libc + headers. We still
+          # need Linux kernel uapi headers (linux/capability.h,
+          # linux/netfilter/*.h, etc.) which musl doesn't ship —
+          # pull them from the glibc-side linux-libc-dev package
+          # via -isystem so they don't clash with libc decls.
+          # -static is the whole point; MSG_COPY define mirrors the
+          # x86_64 build (musl lacks the SysV msg flag).
           make CC=musl-gcc \
-               CFLAGS="-O2 -Wall -Wextra -Wno-unused-parameter -Wno-pointer-arith -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -DMSG_COPY=040000" \
+               CFLAGS="-O2 -Wall -Wextra -Wno-unused-parameter -Wno-pointer-arith -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -DMSG_COPY=040000 -isystem /usr/include -isystem /usr/include/aarch64-linux-gnu" \
                LDFLAGS=-static
           file skeletonkey
           ls -la skeletonkey