release.yml: arm64-static via dockcross/linux-arm64-musl

Third attempt at arm64-static. Previous two:

1. Alpine container on ubuntu-24.04-arm:
   'JavaScript Actions in Alpine containers only supported on x64
   Linux runners' — actions/checkout JS bundle can't run.

2. musl-tools on ubuntu-24.04-arm:
   musl-gcc + Ubuntu's /usr/include collide. -isystem /usr/include
   pulls glibc stdio.h whose __gnuc_va_list + __time64_t types
   conflict with musl's stdio.h. -isystem /usr/include/linux alone
   leaves us missing asm/ headers.

dockcross/linux-arm64-musl avoids both:
  - Image base is Debian (glibc) → actions/checkout works.
  - Ships aarch64-linux-musl-gcc with a CONSISTENT musl + linux-
    uapi sysroot. No header collision.

The dockcross pattern is: pull the image, ask it to spit out its
wrapper script ('docker run --rm dockcross/linux-arm64-musl' prints
a bash wrapper to stdout), then './dockcross bash -c ...' runs the
command inside the toolchain container with the cwd volume-mounted.

Produces a statically-linked aarch64 ELF binary, same packaging
flow as the x86_64-static job.

.github/workflows/release.yml

@@ -94,36 +94,36 @@ jobs:
             skeletonkey-x86_64-static
             skeletonkey-x86_64-static.sha256
 
-  # Portable static-musl arm64 build. Runs natively on GitHub's
+  # Portable static-musl arm64 build. Cross-compile from the x86_64
-  # ubuntu-24.04-arm runner (free for public repos). Can't use the
+  # runner using dockcross/linux-arm64-musl — a Debian-based cross
-  # Alpine container trick here because "JavaScript Actions in Alpine
+  # toolchain image that ships aarch64-linux-musl-gcc with a clean
-  # containers are only supported on x64 Linux runners" — actions/
+  # musl sysroot + Linux uapi headers. Avoids the two prior failure
-  # checkout would fail. Instead we use musl-tools (Ubuntu's
+  # modes:
-  # apt-installed musl-gcc wrapper) on the glibc-based runner; the
+  #   (1) Alpine on arm64: actions/checkout JS bundle requires glibc-
-  # produced binary is still statically linked against musl, just
+  #       compatible Node, which GitHub doesn't inject on arm64.
-  # built outside an Alpine container.
+  #   (2) musl-tools on ubuntu-24.04-arm: musl-gcc + Ubuntu's
+  #       /usr/include collide (glibc stdio.h vs musl stdio.h →
+  #       __gnuc_va_list / __time64_t conflicts).
+  # dockcross runs glibc Debian (so checkout works), invokes a
+  # bundled aarch64-linux-musl-gcc whose sysroot has its own
+  # consistent musl + linux-uapi tree.
   build-static-arm64:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     name: build (arm64-static / musl)
     steps:
       - uses: actions/checkout@v4
-      - name: install musl + build deps
+      - name: run dockcross arm64-musl build
         run: |
-          sudo apt-get update -qq
+          # Fetch the dockcross wrapper script (handles UID/GID,
-          sudo apt-get install -y --no-install-recommends \
+          # volume mounts, env passing). Image already has
-              musl-tools musl-dev linux-libc-dev build-essential
+          # aarch64-linux-musl-gcc on PATH.
-      - name: build static (musl-gcc)
+          docker run --rm dockcross/linux-arm64-musl > ./dockcross
-        run: |
+          chmod +x ./dockcross
-          # musl-gcc wraps gcc with musl's libc + headers. We still
+          ./dockcross bash -c '
-          # need Linux kernel uapi headers (linux/capability.h,
+            make CC=aarch64-linux-musl-gcc \
-          # linux/netfilter/*.h, etc.) which musl doesn't ship —
+                 CFLAGS="-O2 -Wall -Wextra -Wno-unused-parameter -Wno-pointer-arith -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -DMSG_COPY=040000" \
-          # pull them from the glibc-side linux-libc-dev package
-          # via -isystem so they don't clash with libc decls.
-          # -static is the whole point; MSG_COPY define mirrors the
-          # x86_64 build (musl lacks the SysV msg flag).
-          make CC=musl-gcc \
-               CFLAGS="-O2 -Wall -Wextra -Wno-unused-parameter -Wno-pointer-arith -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -DMSG_COPY=040000 -isystem /usr/include -isystem /usr/include/aarch64-linux-gnu" \
                  LDFLAGS=-static
+          '
           file skeletonkey
           ls -la skeletonkey
       - name: rename + checksum