ci: probe glibc linux natives on musl/Alpine (#46)

* ci: probe whether the glibc linux natives load on musl/Alpine

Add a non-gating (continue-on-error) musl-probe job for linux-x86_64 and
linux-aarch64. The natives are built for the *-linux-gnu ABI, so this
checks empirically whether they load on musl rather than guessing.

The action steps (checkout, setup-java, Maven fetch, javac) run on the
glibc host; only the final `java` runs inside an Alpine/musl JDK container
(amazoncorretto:25-alpine), so node-based actions never run under musl. If
the probe fails, the fix is to add x86_64-linux-musl / aarch64-linux-musl
target triples to build-zstd.sh and ship two more native jars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: fold the musl probe into the smoke matrix

Instead of a separate musl-probe job, add the two Alpine/musl legs to the
smoke matrix (container + experimental flags). Steps branch on matrix.container:
native legs run via JBang on the host; musl legs fetch+compile on the glibc
host then run java inside an Alpine/musl JDK container. continue-on-error is
per-leg (matrix.experimental), so the six native legs gate and the two musl
probes don't.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

.github/workflows/release-smoke.yml

@@ -46,40 +46,75 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
   smoke:
-    name: ${{ matrix.classifier }}
+    name: ${{ matrix.classifier }}${{ matrix.container && ' (musl)' || '' }}
     needs: resolve
+    # musl legs are a probe (glibc natives on Alpine, expected to fail until musl
+    # natives ship), so they don't gate the workflow; the six native legs do.
+    continue-on-error: ${{ matrix.experimental || false }}
     strategy:
       fail-fast: false
       matrix:
         # distribution is per-leg for clarity and easy override. Zulu ships JDK 25
-        # for all six targets (incl. Windows/ARM64, which Temurin does not yet) and
-        # matches publish.yml; change a single leg here if a target needs another.
+        # for all targets (incl. Windows/ARM64, which Temurin does not yet) and
+        # matches publish.yml. Legs with `container` run the linux native inside an
+        # Alpine/musl JDK to probe musl support.
         include:
           - { os: ubuntu-latest,    classifier: linux-x86_64,    distribution: zulu }
           - { os: ubuntu-24.04-arm, classifier: linux-aarch64,   distribution: zulu }
           - { os: macos-13,         classifier: osx-x86_64,      distribution: zulu }
           - { os: macos-14,         classifier: osx-aarch64,     distribution: zulu }
           - { os: windows-latest,   classifier: windows-x86_64,  distribution: zulu }
           - { os: windows-11-arm,   classifier: windows-aarch64, distribution: zulu }
+          - { os: ubuntu-latest,    classifier: linux-x86_64,  distribution: zulu, container: "amazoncorretto:25-alpine", experimental: true }
+          - { os: ubuntu-24.04-arm, classifier: linux-aarch64, distribution: zulu, container: "amazoncorretto:25-alpine", experimental: true }
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout (smoke sources only)
         uses: actions/checkout@v4
 
-      - name: Set up JDK 25
+      - name: Set up JDK 25 (host)
         uses: actions/setup-java@v4
         with:
           distribution: ${{ matrix.distribution }}
           java-version: '25'
 
+      # --- native runner path (glibc / macOS / Windows): run via JBang on the host ---
       - name: Set up JBang
+        if: ${{ !matrix.container }}
         uses: jbangdev/setup-jbang@main
 
       - name: Smoke-test ${{ needs.resolve.outputs.version }} on ${{ matrix.classifier }}
+        if: ${{ !matrix.container }}
         shell: bash
         env:
           VERSION: ${{ needs.resolve.outputs.version }}
         run: |
           jbang --java 25 \
             --deps "io.github.dfa1.zstd:zstd:${VERSION},io.github.dfa1.zstd:zstd-native-${{ matrix.classifier }}:${VERSION}" \
             .github/smoke/Smoke.java
+
+      # --- musl probe: fetch + compile on the glibc host, run inside an Alpine/musl
+      #     JDK container, so node-based actions never run under musl ---
+      - name: Fetch released jars and compile the smoke (musl)
+        if: ${{ matrix.container }}
+        shell: bash
+        env:
+          VERSION: ${{ needs.resolve.outputs.version }}
+        run: |
+          mvn -q org.apache.maven.plugins:maven-dependency-plugin:3.8.1:copy \
+            -Dartifact="io.github.dfa1.zstd:zstd:${VERSION}" \
+            -DoutputDirectory=libs -Dmdep.stripVersion=true
+          mvn -q org.apache.maven.plugins:maven-dependency-plugin:3.8.1:copy \
+            -Dartifact="io.github.dfa1.zstd:zstd-native-${{ matrix.classifier }}:${VERSION}" \
+            -DoutputDirectory=libs -Dmdep.stripVersion=true
+          mkdir -p out
+          javac -cp libs/zstd.jar -d out .github/smoke/Smoke.java
+
+      - name: Smoke-test ${{ needs.resolve.outputs.version }} on ${{ matrix.classifier }} (musl/Alpine)
+        if: ${{ matrix.container }}
+        shell: bash
+        run: |
+          docker run --rm -v "$PWD:/w" -w /w "${{ matrix.container }}" \
+            java --enable-native-access=ALL-UNNAMED \
+            -cp "libs/zstd.jar:libs/zstd-native-${{ matrix.classifier }}.jar:out" \
+            Smoke