Check protect-ffi's C library in every build, and stop downloading from musl.cc

[auxesis]

protect-ffi's release build has two gaps that the @cipherstash/auth build had until #1018.

Its C library check runs only in the preflight

ffi-preflight.yml reads which C library each Linux binary links, but nothing starts that dry run automatically. release.yml builds through _build-ffi-artifacts.yml and publishes without the check. So if the musl build stopped linking musl, a release would publish a binary that fails to load on musl systems such as Alpine Linux. That is how the suite published a glibc-linked @cipherstash/auth-linux-x64-musl 0.44.0.

Its musl toolchain comes from musl.cc

_build-ffi-artifacts.yml downloads its musl toolchain from musl.cc. On 2 October 2026, that download timed out from GitHub's runners on six tries in a row, although musl.cc answered from elsewhere. protect-ffi's next release, which #1014 will start, fails at that download if musl.cc is still unreachable.

Fix

1. Add the same C library step as fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library #1018: after each Linux build, read the binary's required libraries with readelf -d. The gnu binaries must require libc.so.6, and the musl binary must not. Add a test like the one in scripts/__tests__/auth-build-artifacts.test.mjs, which checks that the step comes before packing.
2. Stop depending on musl.cc. Build the musl binary inside Alpine Linux, as fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library #1018 does for @cipherstash/auth, or host a copy of the toolchain with its pinned digest.
3. Do this before chore(changeset): release the packages whose links #1000 moved #1014 merges.

Fixed by #1027

#1027 merged on 3 October 2026:

• Each Linux leg of _build-ffi-artifacts.yml now runs scripts/check-c-library.sh on its binary before packing.
• The linux-x64-musl binary now builds inside the same digest-pinned node:22-alpine image as @cipherstash/auth, and the build loads it with Node.js on musl. The build no longer downloads anything from musl.cc.
• Both mise steps in _build-ffi-artifacts.yml now pin mise 2026.4.0. mise 2026.10.0, released on 2 October 2026, broke both gnu builds on main.

After it merged, ffi-preflight.yml passed against main, in run 37083686113.

[auxesis]

Fixed by #1027, which merged on 3 October 2026.