fix(release): build Linux Node clients with Zig

[jeremi]

Summary

• replace the obsolete napi-cross glibc 2.17 compiler with the already hash-pinned Zig 0.12.1 toolchain
• route C, C++, and Rust linking through an exact glibc 2.17 wrapper while retaining the Rust target used for package identity
• prove the shared recipe on GitHub-hosted amd64 and arm64 in path-selected CI and the read-only release rehearsal
• retain generic strong-unversioned import, GLIBC ceiling, package-loader, and Bullseye runtime checks

Release recovery evidence

• candidate 31748263774 proved the earlier compiler routing on amd64 but showed the bundled arm64 GCC/sysroot was too old for ring 0.17.14 and aws-lc-sys 0.44.0
• independent full Evidence addon builds with this Zig recipe passed on amd64 and arm64, required at most GLIBC_2.17, had no unexpected strong unversioned imports, and loaded in the exact pinned Bullseye Node image
• candidate assemble/attest were skipped and v0.22.0 remains untagged and unpublished

Verification

• complete release-tooling unittest suite
• CI classifier: 56 tests
• gate inventory: 151 gates and 53 tests
• bash -n and shellcheck for both new helpers
• full actionlint
• git diff --check

Signed-off-by: Jeremi Joslin jeremi@joslin.fr