[todie]

Adds musl-named release assets to the in-house ug-v* releases, as asked by paas's estate packaging tracker (OPS-1744, M2).

What changes

release-unsigned.yml keeps the existing bare binaries and adds, for each target:

Asset	Contents
herdr-linux-x86_64, herdr-linux-aarch64	unchanged: the bare musl binaries
herdr-<tag>-x86_64-unknown-linux-musl.tar.gz	herdr (0755) at the archive root
herdr-<tag>-aarch64-unknown-linux-musl.tar.gz	herdr (0755) at the archive root
<archive>.sha256	sha256sum output, so sha256sum -c works

The archive names follow cortex's <tool>-<tag>-<triple>.tar.gz. fail_on_unmatched_files: true makes a missing asset fail the release instead of publishing without it.

Why the bare names stay, and why the checksum isn't SHA256SUMS-<triple>

• The bare names stay because the Homebrew formula (unsigned-gg/homebrew-unsigned Formula/herdr.rb) and ceres's mise pin (ubi:unsigned-gg/herdr, exe = "herdr") use them.
• mise's ubi backend (ubi 0.9.0, in mise 2026.5.18) doesn't filter by libc on a glibc host. After OS and arch filtering it takes the first candidate sorted by name (picker.rs pick_asset_from_matches).
  • herdr-linux-* sorts before herdr-ug-v*, so glibc hosts keep getting the bare binary, which is the same musl build.
  • On a musl host, ubi prefers the musl-named archive.
• The checksum is <archive>.sha256 because ubi drops an unknown extension (extension.rs from_path).
  • An extensionless SHA256SUMS-<triple> would match OS and arch, and its uppercase S would sort first. ubi would then install the checksum file.
  • This is read from the ubi source and has not been run. The release check below runs it for herdr.

Not included

• darwin: no estate consumer, and the formula is depends_on :linux. Upstream's release.yml has the macOS jobs to lift when one appears.

Checks

• actionlint gives 2 findings, the same 2 as on the parent commit (SC2001 and SC2086 on untouched lines).
• The packaging step ran locally under bash -e -o pipefail with umask 077 and a stub binary:
  • rc 0, and tar tvzf shows herdr as 0755;
  • sha256sum -c gives OK;
  • the release globs match exactly the 6 assets.
  • The first version used cp and packed the binary as 0700 under umask 077. That is why it now uses install -m 0755.
• After merge: tag ug-v0.9.5.2 (the unsigned head is exactly ug-v0.9.5.1, so the binary source is unchanged).
  • Then mise install ubi:unsigned-gg/herdr@ug-v0.9.5.2 into scratch mise dirs, asserting the picked asset by name.
  • Rollback if the release is wrong: gh release edit ug-v0.9.5.1 --latest.

Refs OPS-1744