The pinned Cross executable still selected mutable main-tagged target images. Cross upgraded those images to Ubuntu 24.04, causing release binaries to require GLIBC_2.38 and GLIBC_2.39 even though the Debian Bookworm runtime only provides GLIBC_2.36.

Pin both GNU target images to the pre-upgrade digests, include the Cross configuration in native cache identities, and verify linked dependencies while assembling the final image so future ABI drift fails during CI instead of deployment healthchecks.