fix(release): enforce Node client glibc toolchain

[jeremi]

What changed

• Route same-architecture AWS-LC C and C++ compilation through napi-rs' pinned glibc 2.17 toolchain for Linux Node client packages.
• Reject unexplained strong, unversioned dynamic imports before packaging while retaining the existing version-table audit and Debian 11 package smoke.
• Bind the compiler selection, symbol audit, and ordering in executable workflow structure tests.

Root cause

Candidate run 31744651325 failed both Linux client lanes on the supported Debian 11 baseline with undefined symbol: __isoc23_sscanf. napi-rs selected its glibc 2.17 linker through TARGET_*, but aws-lc-sys treats same-architecture builds as native and selected the Ubuntu 24.04 host compiler through HOST_*. The mixed toolchains left an unversioned future-glibc import that readelf --version-info could not see.

Impact

The candidate now uses one glibc 2.17 toolchain for Rust linking and AWS-LC C/C++ compilation. The real baseline runtime smoke remains the authoritative compatibility proof. No release metadata or product code changes in this PR.

Verification

• 74 combined release candidate, workflow guard, and structure tests passed
• Targeted and repository-wide actionlint passed
• git diff --check passed
• Executable ELF fixtures reject the observed ISO C23 leak and generic strong unversioned imports, while allowing Node-API, versioned, and weak imports

Candidate evidence: https://github.com/registrystack/registry-stack/actions/runs/31744651325

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f67f0d29cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

Commit e9b789715c1fe3578ad74b3a04e963b0f4f362f1 has no Signed-off-by trailer, so the repository's DCO workflow will reject the contribution; recreate the commit with git commit -s or otherwise add a valid sign-off before submission.

AGENTS.md reference: AGENTS.md:L274-L274

Useful? React with 👍 / 👎.