chore(nix): unify Linux cross-compilation toolchains

[SDAChess]

Summary

Use one Nix development shell to build Linux GNU and musl binaries for x86_64 and aarch64. GNU targets link against an explicit glibc 2.28 sysroot with static native libraries, producing portable executables without post-link ELF rewriting.

This draft opens the branch for the existing Linux and macOS shell-realization checks. Workflow migration and documentation are still pending; this is not ready to merge.

Related Issue

No issue linked yet. This draft is for validating the build-toolchain changes; issue linkage remains to be resolved before marking it ready.

Changes

• Replace the separate GNU and musl shells with one mkShellNoCC shell and four target toolchains.
• Keep target compiler, assembler, archiver, Cargo linker, and AWS-LC settings in toolchain/package passthru.env.
• Use an explicit GNU sysroot, unwrapped compiler driver, and mold; retain OpenShell's pinned Rust version and development tools.
• Include the compiler and glibc adjustments needed for Darwin-to-Linux toolchain builds.

Testing

• Realized .#devShells.x86_64-linux.default locally with nix build --no-link.
• Evaluated the default shell for x86_64 Linux, aarch64 Linux, and aarch64 Darwin.
• Built the entire Cargo workspace in debug mode for x86_64/aarch64, GNU/musl, from x86_64 Linux.
• Checked all 40 executables: GNU binaries use standard interpreters, have no RPATH/RUNPATH, and require no symbols newer than glibc 2.28; musl binaries pass the repository's static-linkage verifier.
• All 40 executables passed --version, natively on x86_64 and under QEMU on aarch64.
• Nix formatting and git diff --check pass.
• mise run pre-commit: attempted, but mise is not installed in the local environment.
• Full unit/E2E tests and mise run ci have not been run.
• macOS toolchain realization/build validation is pending CI.

The VM driver was built with its default empty embedded-resource stubs; VM startup was not tested. Existing build/E2E workflows still reference the removed shell names, and the shared build action still performs normalization. Those workflows and native test integration need follow-up before this draft is ready.

Checklist

• Follows Conventional Commits.
• Commit signed and signed off for DCO.
• Architecture/build documentation updated.
• Existing CI workflows migrated to the single shell and explicit Cargo targets.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[SDAChess]

/ok-to-test 7e53559

[SDAChess]

/ok-to-test 675411f

[SDAChess]

/ok-to-test dc6a328

[SDAChess]

/ok-to-test 6067054