fix(release): correct static-binary verification for musl static-PIE

The musl release binary is static-PIE, which `ldd` reports as a dynamic
executable even with zero shared-library deps, so the old `ldd | grep "not a
dynamic executable"` check failed a perfectly static binary. Assert staticness
via `file` (must not be "dynamically linked") and `readelf -d` (no NEEDED
entries) instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLzpDUMcQg8KWBdTpw61eb

.gitea/workflows/release.yml

@@ -47,9 +47,19 @@ jobs:
 
       - name: Verify the binary is static
         run: |
-          file target/x86_64-unknown-linux-musl/release/cichlid
-          ldd target/x86_64-unknown-linux-musl/release/cichlid 2>&1 | grep -q "not a dynamic executable" \
-            || { echo "Error: binary is not statically linked"; exit 1; }
+          bin=target/x86_64-unknown-linux-musl/release/cichlid
+          file "$bin"
+          # musl release is static-PIE, which ldd reports as a dynamic
+          # executable even with zero shared-library deps. Assert staticness two
+          # ways instead: `file` must not say "dynamically linked", and the ELF
+          # must carry no NEEDED shared-library entries.
+          if file "$bin" | grep -q "dynamically linked"; then
+            echo "Error: binary is dynamically linked"; exit 1
+          fi
+          if readelf -d "$bin" 2>/dev/null | grep -q "(NEEDED)"; then
+            echo "Error: binary has shared-library dependencies"; exit 1
+          fi
+          echo "OK: statically linked"
 
       - name: Run tests
         run: cargo test --workspace