fix(ci): enforce glibc 2.28 floor for Linux releases

[vinceblock99]

Summary

• Build the existing x86_64 and aarch64 Linux GNU release artifacts with cargo-zigbuild against an explicit glibc 2.28 floor.
• Fail the release if the generated ELF requires a newer GLIBC symbol version, preventing runner upgrades from silently raising compatibility requirements again.
• Pin the Zig setup action to an immutable SHA and restrict the version/build jobs to read-only repository permissions.

This preserves the current GNU artifact names and fixes their compatibility directly. PR #183 takes the alternative approach of adding separate musl artifacts while leaving the GNU artifacts unchanged.

Root cause

The v0.17.1 GNU binaries were built directly on ubuntu-latest, so they inherited GLIBC 2.38/2.39 symbols from the hosted runner and failed to start on Ubuntu 22.04 (glibc 2.35).

Test coverage

No application code paths changed. The release workflow now validates both Linux GNU artifacts against the declared GLIBC floor.

Verification

• cargo test --workspace
• actionlint
• Built x86_64-unknown-linux-gnu.2.28 and aarch64-unknown-linux-gnu.2.28 with cargo-zigbuild 0.23.4 / Zig 0.16.0
• Confirmed both ELF artifacts require at most GLIBC_2.28
• Ran both artifacts successfully on Ubuntu 20.04 and Ubuntu 22.04 containers
• Confirmed the compatibility gate rejects the published v0.17.1 artifact (GLIBC_2.39) and accepts the rebuilt artifact (GLIBC_2.28)

Review notes

The remaining non-blocking follow-up is to run baseline-distro smoke tests in PR CI so future loader, shared-library, or CPU-baseline regressions are caught before a release.

Fixes #181