fix(ci): accept static-pie binaries in the static-link check

`file` on the Ubuntu CI runner reports our musl binary as
"static-pie linked" (position-independent + statically linked) rather
than "statically linked" — that's the modern default for musl + Rust
1.93 and means the binary is fully static, not dynamically linked.

Our grep only accepted the older "statically linked" string, so the
check rejected a perfectly-static binary. See run 25212930359 (job
"Static (musl) Build", step "Confirm binary is statically linked").

Now accept either form, and add a positive check that the binary
isn't "dynamically linked" (defence in depth — if `file`'s output
ever changes again to some new third form, we'll catch
"dynamically linked" still being absent).

The binary itself is unchanged; only the verification logic moved.

Author: lfrancke

.github/workflows/build.yaml

@@ -77,7 +77,13 @@ jobs:
         run: |
           file target/x86_64-unknown-linux-musl/release/postgresql-trino-gateway \
             | tee /tmp/file.out
-          grep -q "statically linked" /tmp/file.out
+          # `file` reports a fully-static musl binary as either
+          # "statically linked" (older builds) or "static-pie linked"
+          # (newer Rust + musl default — position-independent AND
+          # statically linked). Both are fine; reject only "dynamically
+          # linked".
+          grep -qE 'statically linked|static-pie linked' /tmp/file.out
+          ! grep -q 'dynamically linked' /tmp/file.out
 
   # Single required check for branch protection rules.
   finished: