ci(shred-proxy): accept static-pie in the release linkage assert

.github/workflows/release.shred-proxy.yml

@@ -62,8 +62,11 @@ jobs:
           cp "target/${TARGET}/release/shred-proxy" "dist/${ASSET}"
           # Assert (not just print) that it really is static — a dynamic build would fail on hosts
           # without the same libc, so a non-static artifact must fail the release, not ship silently.
+          # A musl release build links as a PIE by default, which `file` reports as "static-pie
+          # linked" (still no interpreter / no shared-lib deps) rather than "statically linked";
+          # accept both so a genuinely static binary isn't rejected.
           file "dist/${ASSET}"
-          if ! file "dist/${ASSET}" | grep -q 'statically linked'; then
+          if ! file "dist/${ASSET}" | grep -Eq 'statically linked|static-pie linked'; then
             echo "error: ${ASSET} is not statically linked — refusing to publish" >&2
             exit 1
           fi

CHANGELOG.md

@@ -38,7 +38,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     clean `ip route get` non-zero exit → treated as inactive) from a genuine probe failure
     (spawn/decode error → keep current), so a routeless unsubscribed candidate on a host with no
     default route can't stall activation. Release publishes pin a dispatch-created tag to the built
-    commit (`--target`), and the shipped env example documents `sigverify`/`DZ_RPC_URL`.
+    commit (`--target`), and the shipped env example documents `sigverify`/`DZ_RPC_URL`. The
+    static-linkage assertion now also accepts `file`'s `static-pie linked` wording (a musl release
+    build links as a PIE by default), so a genuinely static binary is no longer rejected at publish.
 - **Per-tick win counters** `dz_quote_ticks_won_total{venue, publisher}` /
   `dz_depth_ticks_won_total{venue, publisher}` — the published win-rate primitive. Every
   `source_ts` tick counts exactly once, for the publisher class whose copy arrived first: a