ANW-30 CI: cross-compile arm64 on the host runner

The arm64 (apple-silicon) target assumed a native macOS runner, which
does not exist on the forge. There is one self-hosted runner, ws-brn,
registered linux-amd64:host -- jobs run directly on the host as brn,
with no docker. So cross-rs cannot run (no container engine), and it
cannot target apple-darwin from Linux regardless.

Build arm64 by native cross-compilation instead: rustup target add
aarch64-unknown-linux-gnu plus the host's aarch64-linux-gnu-gcc linker.
Same arm64 binary, no docker. The asset is now aarch64-linux.

Also drop the host-incompatible setup steps surfaced by running it on
the real runner: hurl is already installed (the sudo dpkg step failed,
brn has no passwordless sudo) and the aarch64 linker is already present.
Split a single test gate (test + hurl) from the per-target build matrix.

Pass inputs.tag via env to the staging step (sie review note, ANW-30).

.forgejo/workflows/build.yml

@@ -16,6 +16,13 @@
 # stable release. forgejo-release creates the release (from the checked-out
 # sha) if it does not exist, and `override: true` lets a re-run replace the
 # assets.
+#
+# Runner topology. There is one self-hosted runner registered `linux-amd64`
+# with `:host` execution -- jobs run directly on the host, not in a
+# container. The host already provides node, git, rustup/cargo, hurl, and the
+# aarch64 cross linker, so the workflow uses them in place rather than
+# installing anything (the host user has no passwordless sudo). Both targets
+# build on this one amd64 host: x86_64 natively, aarch64 by cross-compilation.
 name: build
 
 on:
@@ -35,73 +42,77 @@ permissions:
   contents: write
 
 jobs:
+  # Single test gate for both targets. The suite and the HTTP contract
+  # harness are architecture-independent, so they run once, natively on the
+  # amd64 host. Both build jobs depend on this, so a release never ships a
+  # red build.
+  test:
+    name: test
+    runs-on: linux-amd64
+    steps:
+      - name: Check out the workflow ref
+        uses: actions/checkout@v4
+
+      - name: Cache cargo registry, index, and target
+        uses: https://github.com/Swatinem/rust-cache@v2
+
+      - name: Run the Rust test suite
+        run: cargo test --locked
+
+      # The HTTP contract harness (tests/run-hurl.sh, per ADR-008) boots
+      # `anwesen serve` and runs hurl against it -- headless, so it runs in CI.
+      - name: Run the HTTP contract tests
+        run: tests/run-hurl.sh
+
   build:
     name: ${{ matrix.label }}
-    # NOTE: these labels must match the labels your act_runner registered
-    # with -- adjust to your forge's runner topology. `linux-amd64` assumes a
-    # Linux host with a C toolchain (cc/ld) for the native build; `macos-arm64`
-    # assumes a native Apple Silicon macOS runner. There is no GitHub-hosted
-    # macOS on a self-hosted forge, so the arm64 build needs a registered Mac.
-    runs-on: ${{ matrix.runner }}
+    needs: test
+    runs-on: linux-amd64
     strategy:
       # One target's failure should not cancel the other's build.
       fail-fast: false
       matrix:
         include:
-          # amd64 Linux -- the deploy target. Built natively.
-          - runner: linux-amd64
+          # amd64 Linux -- the deploy target. Built natively for the host.
+          - target: x86_64-unknown-linux-gnu
             label: x86_64-linux
-            os: linux
-          # arm macOS (apple silicon) -- aav's local machine. Built natively.
-          - runner: macos-arm64
-            label: aarch64-macos
-            os: macos
+          # arm64 Linux -- cross-compiled on the same amd64 host. cross-rs
+          # would need a container engine the host runner does not provide
+          # (and cannot target apple-darwin from Linux anyway), so this uses
+          # the rustup target plus the host's aarch64-linux-gnu-gcc linker.
+          - target: aarch64-unknown-linux-gnu
+            label: aarch64-linux
+    env:
+      # cargo picks the linker for the aarch64 target from this; the host
+      # already provides aarch64-linux-gnu-gcc. Harmless for the amd64 target.
+      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
     steps:
       - name: Check out the workflow ref
         uses: actions/checkout@v4
 
-      # Stable channel; edition 2024 needs >= 1.85, and Cargo.toml pins the
-      # MSRV at 1.95. Pin an explicit version here if a frozen release
-      # toolchain is ever required.
-      - name: Install the Rust toolchain
-        uses: https://github.com/dtolnay/rust-toolchain@stable
-
       - name: Cache cargo registry, index, and target
         uses: https://github.com/Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
 
-      # The HTTP contract harness (tests/run-hurl.sh, per ADR-008) boots
-      # `anwesen serve` and runs hurl against it -- headless, so it runs in CI.
-      # The HTTP contract is arch-independent, so it runs once on Linux; the
-      # macOS runner's stock bash is 3.2 and the harness needs bash 4+
-      # (`shopt -s globstar`), which would only add fragility for no extra
-      # coverage.
-      - name: Install hurl
-        if: matrix.os == 'linux'
-        run: |
-          curl -fsSL -o /tmp/hurl.deb \
-            https://github.com/Orange-OpenSource/hurl/releases/download/8.0.0/hurl_8.0.0_amd64.deb
-          sudo dpkg -i /tmp/hurl.deb
-
-      # Test before building the artifact so a release never ships a red build.
-      # The debug build here is what run-hurl.sh exercises.
-      - name: Run the Rust test suite
-        run: cargo test --locked
-
-      - name: Run the HTTP contract tests
-        if: matrix.os == 'linux'
-        run: tests/run-hurl.sh
+      # The host toolchain is rustup-managed; ensure the cross target's std
+      # is present. Idempotent for the native target.
+      - name: Add the Rust target
+        run: rustup target add ${{ matrix.target }}
 
       - name: Build the release binary
-        run: cargo build --release --locked
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
-      # The runner is native to its target, so target/release/anwesen is the
-      # target binary. forgejo-release uploads everything under the release
-      # dir, so the staged name is the asset name -- make the target explicit.
+      # forgejo-release uploads everything under the release dir, so the
+      # staged name is the asset name -- make the target explicit. The tag
+      # goes through env, not direct interpolation into the run body.
       - name: Stage the asset for its target
+        env:
+          TAG: ${{ inputs.tag }}
         run: |
           mkdir -p dist/release
-          install -m 0755 target/release/anwesen \
-            "dist/release/anwesen-${{ inputs.tag }}-${{ matrix.label }}"
+          install -m 0755 "target/${{ matrix.target }}/release/anwesen" \
+            "dist/release/anwesen-${TAG}-${{ matrix.label }}"
 
       - name: Publish the binary to the Forgejo release
         uses: https://code.forgejo.org/actions/forgejo-release@v2