feat: include Linux ARM64 in native Codex runner targets

Ship a source-bound ARM64 daemon alongside Linux x64 and both Mac targets.
Use native hosted builds and the existing clean npm/native startup verifier.
Read target requirements from the immutable source to preserve historical
three-target promotions. Keep Codex payloads as official npm dependencies.

Resolve ARM64 creation and login through the shared platform contract. Share
the existing legacy CLI permission calculation with import previews without
changing execution behavior. Record targeted checks and live Mac evidence.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/release-smoke.yml

@@ -24,7 +24,7 @@ on:
         default: release-smoke
         type: string
       qualification_source_sha:
-        description: Optional immutable source SHA for provider-free three-target package qualification
+        description: Optional immutable source SHA for provider-free native package qualification
         required: false
         default: ""
         type: string
@@ -282,7 +282,7 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
-  qualification_mac:
+  qualification_native:
     if: ${{ !cancelled() && inputs.qualification_source_sha != '' && needs.qualification_daemons.result == 'success' }}
     needs: [qualification_daemons, qualification_pack]
     name: Clean installed package (${{ matrix.target }})
@@ -290,12 +290,7 @@ jobs:
     timeout-minutes: 30
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - target: darwin-arm64
-            host: macos-15
-          - target: darwin-x64
-            host: macos-15-intel
+      matrix: ${{ fromJSON(needs.qualification_daemons.outputs.native_consumer_matrix) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -321,12 +316,14 @@ jobs:
           set -euo pipefail
           [[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
           [[ "$(node -p 'process.platform + "-" + process.arch')" == "$TARGET" ]] || exit 1
-          node scripts/verify-grok-npm-install.mjs --mac-consumer \
-            "$RUNNER_TEMP/public-runner-packs" "$SOURCE_SHA" "$RUNNER_TEMP/mac-public-install.json"
+          mode=--mac-consumer
+          if [[ "$TARGET" == linux-arm64 ]]; then mode=--linux-arm64-consumer; fi
+          node scripts/verify-grok-npm-install.mjs "$mode" \
+            "$RUNNER_TEMP/public-runner-packs" "$SOURCE_SHA" "$RUNNER_TEMP/native-public-install.json"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: ${{ inputs.artifact_name }}-${{ matrix.target }}
-          path: ${{ runner.temp }}/mac-public-install.json
+          path: ${{ runner.temp }}/native-public-install.json
           if-no-files-found: warn
           retention-days: 14

.github/workflows/release-verify.yml

@@ -15,6 +15,8 @@ on:
     outputs:
       runner_artifact_prefix:
         value: ${{ jobs.runner_binaries.outputs.artifact_prefix }}
+      native_consumer_matrix:
+        value: ${{ jobs.runner_binary_targets.outputs.native_consumers }}
 
 # Caller-provided refs may name unmerged PR code. AWS is eligible only when
 # the caller runs on canonical master and verifies that event's exact SHA.
@@ -459,8 +461,48 @@ jobs:
       - name: Build
         run: pnpm build
 
+  runner_binary_targets:
+    if: inputs.runner_binaries_only
+    name: Read exact-source daemon targets
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.targets.outputs.matrix }}
+      native_consumers: ${{ steps.targets.outputs.native_consumers }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+      - name: Preserve the immutable source's platform contract
+        id: targets
+        env:
+          SOURCE_SHA: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+          [[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
+          [[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { appendFileSync } from 'node:fs';
+          import { RELEASE_RUNNER_TARGETS } from './packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs';
+          const historical = ['darwin-arm64', 'darwin-x64', 'linux-x64'];
+          const current = [...historical, 'linux-arm64'];
+          const targets = [...RELEASE_RUNNER_TARGETS].sort();
+          assert.ok(JSON.stringify(targets) === JSON.stringify(historical.sort()) || JSON.stringify(targets) === JSON.stringify(current.sort()), 'Unknown exact-source daemon platform contract');
+          const hosts = { 'linux-x64': 'ubuntu-latest', 'linux-arm64': 'ubuntu-24.04-arm', 'darwin-arm64': 'macos-15', 'darwin-x64': 'macos-15-intel' };
+          const include = RELEASE_RUNNER_TARGETS.map(target => ({ target, host: hosts[target] }));
+          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\nnative_consumers=${JSON.stringify({ include: include.filter(row => row.target !== 'linux-x64') })}\n`);
+          NODE
+
   runner_binaries:
     if: inputs.runner_binaries_only
+    needs: runner_binary_targets
     name: Release daemon (${{ matrix.target }})
     runs-on: ${{ matrix.host }}
     timeout-minutes: 30
@@ -468,14 +510,7 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - target: linux-x64
-            host: ubuntu-latest
-          - target: darwin-arm64
-            host: macos-15
-          - target: darwin-x64
-            host: macos-15-intel
+      matrix: ${{ fromJSON(needs.runner_binary_targets.outputs.matrix) }}
     outputs:
       artifact_prefix: ${{ steps.identity.outputs.artifact_prefix }}
     steps:

.github/workflows/release.yml

@@ -342,7 +342,7 @@ jobs:
 
   release_runner_source:
     # Old promotions retain their already-shipped packaging contract. New
-    # sources opt into mandatory three-target assembly in their release.sh.
+    # sources opt into source-declared native target assembly in their release.sh.
     needs: [verify_canary, select_nightly, select_beta, preflight_stable]
     if: >-
       !cancelled() && (