build(plugin): add Python-free musl native artifacts

[kmbroai]

Summary

Prepare native OS primitives for Linux installations that use musl, so the TypeScript migration can preserve Alpine support.

Changes

• Distinguish GNU and musl Linux payloads using the Node diagnostic report header.
• Add native x64 and arm64 musl builds with pinned Rust and Node container images, offline compilation, and no Python dependency.
• Check ELF architecture and libc requirements, then test each unchanged binary on Node 20.0 and 22.13.

Testing

• The x64 musl binary passed the full native proof on Node 20.0 with musl 1.2.3 and Node 22.13 with musl 1.2.5, with an empty PATH and networking disabled.
• The GNU x64 binary passed the glibc 2.28 check and full proof on Node 20.0 and 22.13. Cross-swapping GNU and musl binaries was rejected.
• TypeScript compilation, types, formatting, portable source checks, Ruff, workflow lint, and six plugin build tests passed.
• Three independent native reviews and separate verification found no actionable issues on the final commit.
• The unchanged arm64 musl binary also passed the full proof on those Node 20 and 22 images under local emulation. Its check attributes GCC compatibility versions to their providing library; the native arm64 hosted job must pass after that correction.

Risk and rollout

Stacked on #795. This prepares build artifacts; product commands continue using their existing helpers. Universal package assembly and platform proofs remain required before TypeScript callers replace Python.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-03T01:11:08.310116Z	12303d2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

I see the correction in 12303d2. The validator now attributes version requirements to their providing libraries, including the libgcc_s.so.1 compatibility case.

The current hosted arm64 musl job is still running. Holding approval until this head passes the ELF check, runs the same artifact through the Node 20 and 22 proofs, and uploads the verified artifact. The previous head stopped before the runtime proofs and upload; the new native-runner result will verify the fix.

[mldangelo-oai]

Reviewed the validator correction in 12303d2. The hosted arm64 musl job now passes ELF validation, runs the same artifact successfully on Node 20.0.0 and 22.13.0, and uploads the verified artifact. Both musl architectures and the current SDK CI run pass on this head. This clears my earlier approval hold.