release: ship the Linux Rust binaries as static musl builds (#12284)

* ci: share the musl Rust target setup as a composite action

Three container workflows carried the same toolchain, musl-tools and
aws-lc-sys link shim block verbatim.

* release: ship weed-worker as a static musl binary

The gnu build inherits the runner's glibc, 2.39 since the move to
ubuntu-24.04, so the released worker failed to start on Ubuntu 22.04
with 'GLIBC_2.38 not found'. The container images already build it
against musl with the same recipe.

* release: ship the Linux weed-volume as a static musl binary

Same glibc trap as the worker. The arm64 job also installed libssl,
which nothing in the volume links.

* ci: resolve the manual latest build's actions from master

Its checkout is an arbitrary source ref that may predate a local
action; the workflow itself always runs from master.

.github/workflows/container_release_unified.yml

@@ -55,57 +55,14 @@ jobs:
             arch: amd64
           - target: aarch64-unknown-linux-musl
             arch: arm64
-            cross: true
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up the musl target
+        uses: ./.github/actions/rust-musl-target
         with:
-          targets: ${{ matrix.target }}
-
-      - name: Install musl tools (amd64)
-        if: ${{ !matrix.cross }}
-        run: |
-          sudo apt-get install -y musl-tools
-          # C deps (aws-lc-sys) must compile against musl headers, not the host
-          # gcc's glibc headers — glibc's C23 redirects (__isoc23_sscanf,
-          # __isoc23_strtol) don't exist in musl and fail the link.
-          echo "CC_x86_64_unknown_linux_musl=musl-gcc" >> "$GITHUB_ENV"
-
-      - name: Install cross-compilation tools (arm64)
-        if: matrix.cross
-        run: |
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
-          echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
-          # aws-lc-sys compiles against glibc headers, which redirect
-          # sscanf/strtol to C23 __isoc23_* symbols musl does not provide.
-          # Link a tiny forwarding shim so those references resolve to the
-          # musl implementations. Prototypes are declared manually: including
-          # glibc headers here would re-redirect the calls back to __isoc23_*.
-          cat > /tmp/isoc23-shim.c <<'SHIM'
-          #include <stdarg.h>
-          extern int vsscanf(const char *s, const char *fmt, va_list ap);
-          extern long strtol(const char *nptr, char **endptr, int base);
-          int __isoc23_sscanf(const char *s, const char *fmt, ...) {
-              va_list ap;
-              va_start(ap, fmt);
-              int r = vsscanf(s, fmt, ap);
-              va_end(ap);
-              return r;
-          }
-          long __isoc23_strtol(const char *nptr, char **endptr, int base) {
-              return strtol(nptr, endptr, base);
-          }
-          SHIM
-          aarch64-linux-gnu-gcc -O2 -c /tmp/isoc23-shim.c -o /tmp/isoc23-shim.o
-          # link-args land after libc on the link line; rescan musl libc so
-          # the shim's own vsscanf/strtol references resolve, and libgcc for
-          # the fp128 builtins musl's vfscanf/floatscan pull in on aarch64.
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=-Clink-arg=/tmp/isoc23-shim.o -Clink-arg=-lc -Clink-arg=-lgcc" >> "$GITHUB_ENV"
+          target: ${{ matrix.target }}
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'