The earlier attribution was wrong: a stale podman bind-mount cache made
local container tests execute an older, different build than the host-side
100/100-pass loop, so packed-vs-unpacked was never comparing the same bytes.
Controlled re-test in a single container (fresh build, sha-verified):
the plain unpacked v4 binary fails 100/100 on this AVX2-only machine with
SIGILL at 'vmovdqu64 ... %zmm6' (gdb-confirmed) — the v4 tuning itself
executes AVX-512 on the --version path, which is correct-and-expected
behavior for x86-64-v4 artifacts on non-v4 CPUs.

UPX restored for linux artifacts and docker images; the static-pie file
assertion deliberately runs BEFORE packing (post-pack `file` phrasing
changes — that was the actual CI check failure). The CARGO_TARGET_*_
RUSTFLAGS scoping fix stands: build scripts are host units and must not
receive target-cpu tuning (the original num-traits SIGILL on the runner).