release: ship the Linux Rust binaries as static musl builds (#12284)

* ci: share the musl Rust target setup as a composite action

Three container workflows carried the same toolchain, musl-tools and
aws-lc-sys link shim block verbatim.

* release: ship weed-worker as a static musl binary

The gnu build inherits the runner's glibc, 2.39 since the move to
ubuntu-24.04, so the released worker failed to start on Ubuntu 22.04
with 'GLIBC_2.38 not found'. The container images already build it
against musl with the same recipe.

* release: ship the Linux weed-volume as a static musl binary

Same glibc trap as the worker. The arm64 job also installed libssl,
which nothing in the volume links.

* ci: resolve the manual latest build's actions from master

Its checkout is an arbitrary source ref that may predate a local
action; the workflow itself always runs from master.

.github/actions/rust-musl-target/action.yml

@@ -0,0 +1,57 @@
+name: Set up a musl Rust target
+description: Install the stable toolchain for a static Linux musl target, with the C toolchain and the link shims aws-lc-sys needs.
+inputs:
+  target:
+    description: x86_64-unknown-linux-musl or aarch64-unknown-linux-musl
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: ${{ inputs.target }}
+
+    - name: Install musl tools (amd64)
+      if: inputs.target == 'x86_64-unknown-linux-musl'
+      shell: bash
+      run: |
+        sudo apt-get install -y musl-tools
+        # C deps (aws-lc-sys) must compile against musl headers, not the host
+        # gcc's glibc headers — glibc's C23 redirects (__isoc23_sscanf,
+        # __isoc23_strtol) don't exist in musl and fail the link.
+        echo "CC_x86_64_unknown_linux_musl=musl-gcc" >> "$GITHUB_ENV"
+
+    - name: Install cross-compilation tools (arm64)
+      if: inputs.target == 'aarch64-unknown-linux-musl'
+      shell: bash
+      run: |
+        sudo apt-get install -y gcc-aarch64-linux-gnu
+        echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+        # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
+        echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
+        # aws-lc-sys compiles against glibc headers, which redirect
+        # sscanf/strtol to C23 __isoc23_* symbols musl does not provide.
+        # Link a tiny forwarding shim so those references resolve to the
+        # musl implementations. Prototypes are declared manually: including
+        # glibc headers here would re-redirect the calls back to __isoc23_*.
+        cat > /tmp/isoc23-shim.c <<'SHIM'
+        #include <stdarg.h>
+        extern int vsscanf(const char *s, const char *fmt, va_list ap);
+        extern long strtol(const char *nptr, char **endptr, int base);
+        int __isoc23_sscanf(const char *s, const char *fmt, ...) {
+            va_list ap;
+            va_start(ap, fmt);
+            int r = vsscanf(s, fmt, ap);
+            va_end(ap);
+            return r;
+        }
+        long __isoc23_strtol(const char *nptr, char **endptr, int base) {
+            return strtol(nptr, endptr, base);
+        }
+        SHIM
+        aarch64-linux-gnu-gcc -O2 -c /tmp/isoc23-shim.c -o /tmp/isoc23-shim.o
+        # link-args land after libc on the link line; rescan musl libc so
+        # the shim's own vsscanf/strtol references resolve, and libgcc for
+        # the fp128 builtins musl's vfscanf/floatscan pull in on aarch64.
+        echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=-Clink-arg=/tmp/isoc23-shim.o -Clink-arg=-lc -Clink-arg=-lgcc" >> "$GITHUB_ENV"