ci(release): pin beyond-queue glibc to 2.39 via cargo-zigbuild

The release-api workflow built the binary with native `cargo build`,
linking the runner's glibc unpinned. When the runner's glibc exceeds the
noble (24.04) floor of 2.39, the resulting binary fails to boot on the
target host.

Build via cargo-zigbuild against the `*-linux-gnu.2.39` targets so the
glibc symbol versioning ceiling is pinned to 2.39 regardless of the
runner's system glibc. Keep glibc (not musl): beyond-queue does internal
DNS lookups to postgres, and musl's resolver is unreliable for that.

- mise.toml: add `zig` + `cargo:cargo-zigbuild` tools.
- release-api.yml: add matrix `zigtarget` (x86_64/aarch64 .2.39) and
  base `target` for the output dir; build with `cargo zigbuild
  --target <zigtarget> -p beyond-queue`; package from
  target/<target>/release. Tag, asset name, and gh-release unchanged.

Verified locally: `cargo zigbuild --release --target
x86_64-unknown-linux-gnu.2.39 -p beyond-queue` builds; max required
symbol is GLIBC_2.38 (under the 2.39 ceiling).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jaredLunde

.github/workflows/release-api.yml

@@ -15,8 +15,12 @@ jobs:
         include:
           - os: ubuntu-latest
             arch: amd64
+            target: x86_64-unknown-linux-gnu
+            zigtarget: x86_64-unknown-linux-gnu.2.39
           - os: ubuntu-24.04-arm
             arch: arm64
+            target: aarch64-unknown-linux-gnu
+            zigtarget: aarch64-unknown-linux-gnu.2.39
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
@@ -26,13 +30,16 @@ jobs:
         run: sudo apt-get install -y libreadline-dev uuid-dev
       - uses: jdx/mise-action@v4
       - uses: Swatinem/rust-cache@v2
+      # Pin glibc 2.39 via cargo-zigbuild so the binary boots on noble (24.04)
+      # and never links a newer glibc symbol from the runner. Pure-Rust crate,
+      # but we keep glibc (not musl) for a reliable internal-DNS resolver.
       - name: build
-        run: cargo build --release --bin beyond-queue
+        run: cargo zigbuild --release --target ${{ matrix.zigtarget }} -p beyond-queue
       - name: package
         run: |
           VERSION=${GITHUB_REF_NAME#api-v}
           tar -czf beyond-queue-v${VERSION}-linux-${{ matrix.arch }}.tar.gz \
-            -C target/release beyond-queue
+            -C target/${{ matrix.target }}/release beyond-queue
       - uses: actions/upload-artifact@v7
         with:
           name: binary-${{ matrix.arch }}

mise.toml

@@ -8,6 +8,10 @@ yamlfmt = "latest"
 cargo-binstall = "latest"
 "cargo:sqlx-cli" = "latest"
 "cargo:cross" = "latest"
+# Release binaries are built with cargo-zigbuild pinned to glibc 2.39 (the
+# noble/24.04 floor) so the runner's newer glibc never leaks into the link.
+zig = "latest"
+"cargo:cargo-zigbuild" = "latest"
 node = "lts"
 postgres = "18"