feat(installer): build for and install on linux-aarch64

Step 4 of PLAN.md §5.2, and the half that faces the operator: the
release now cross-compiles aarch64-unknown-linux-gnu, and platform_key()
resolves ("linux","aarch64") to the bundle key link publishes under
instead of refusing the host by name.

Same toolchain shape as the Windows step -- a linker plus a CC/AR pair,
because ring (under ureq's rustls) compiles C and assembly. And the same
packaging trap named in the sums comment: an artifact missing from
SHA256SUMS is one `sha256sum -c` passes over silently, so the new binary
is added to both the sums and the upload list.

Two test changes fall out of the asset map growing a key:

- The exact `assets.len() == 2` assertion is replaced by a check that
  each key CI requires is present and well-formed. An exact count would
  fail on the first bundle that adds arm64 -- reporting correct
  behaviour as a regression.
- The host-binary lookup now accepts either outcome, and says why.
  Bundles are kept unchanged forever so `--bundle` stays reproducible,
  which means one published before arm64 existed can never gain that
  key. On such a host the run must fail with the reason rather than
  something that reads like a corrupt document, so sidecar_asset()'s
  error now says so and the test asserts it.

Verified by cross-building this crate for aarch64 in a
rust:1-slim-bookworm container -- ELF 64-bit LSB pie executable, ARM
aarch64 -- and by running fmt, clippy -D warnings and the tests on both
Linux and the Windows host, since only half of service.rs compiles on
either.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -66,6 +66,9 @@ env:
   BIN: runicgateway-installer
   LINUX_TARGET: x86_64-unknown-linux-gnu
   WINDOWS_TARGET: x86_64-pc-windows-gnu
+  # The installer has to run wherever the sidecar it installs can run, and link
+  # publishes an arm64 Linux binary from v1.2.0 (PLAN.md §5.2, step 4 of 4).
+  ARM64_TARGET: aarch64-unknown-linux-gnu
 
 jobs:
   release:
@@ -237,7 +240,7 @@ jobs:
           echo "Release credentials present."
 
       # ── RUST ADAPTER: toolchain + cross-compile deps ─────────────────────
-      - name: Install Rust toolchain, Windows target, and MinGW linker
+      - name: Install Rust toolchain, cross targets, and their linkers
         if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set -euo pipefail
@@ -254,6 +257,7 @@ jobs:
           export PATH="${HOME}/.cargo/bin:${PATH}"
           rustup component add rustfmt
           rustup target add "${WINDOWS_TARGET}"
+          rustup target add "${ARM64_TARGET}"
 
       - name: Set the crate version to match the release
         if: ${{ steps.plan.outputs.release == 'true' }}
@@ -299,8 +303,12 @@ jobs:
         run: |
           set -euo pipefail
           cp "target/${LINUX_TARGET}/release/${BIN}"        "dist/${BIN}-linux-x86_64"
+          cp "target/${ARM64_TARGET}/release/${BIN}"        "dist/${BIN}-linux-aarch64"
           cp "target/${WINDOWS_TARGET}/release/${BIN}.exe"  "dist/${BIN}-windows-x86_64.exe"
-          ( cd dist && sha256sum "${BIN}-linux-x86_64" "${BIN}-windows-x86_64.exe" > SHA256SUMS )
+          # Every artifact must be listed: `sha256sum -c` passes silently over a
+          # file the sums do not mention, and an operator verifying a download
+          # would get a pass on a binary nobody vouched for.
+          ( cd dist && sha256sum "${BIN}-linux-x86_64" "${BIN}-linux-aarch64"               "${BIN}-windows-x86_64.exe" > SHA256SUMS )
           ls -l dist && echo "----" && cat dist/SHA256SUMS
 
       # ── RELEASE ENGINE: commit the bump, tag, push ───────────────────────
@@ -365,7 +373,7 @@ jobs:
             | jq -r '.id')"
           echo "Created release ${TAG} (id=${REL_ID})"
 
-          for f in "${BIN}-linux-x86_64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
+          for f in "${BIN}-linux-x86_64" "${BIN}-linux-aarch64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
             curl -sSf -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
               -H "Authorization: token ${CI_TOKEN}" \
               -F "attachment=@dist/${f}" >/dev/null