fix(ci): extract reusable workflow for the native cross-compilation matrix

[carlos-alm]

Summary

• build-native.yml's build job and publish.yml's build-native job each defined the same 6-target cross-compilation matrix (linux-x64, linux-arm64 cross, linux-x64-musl cross, macos-latest, macos-14, windows-latest) with near-identical steps — publish.yml's copy just adds a "Sync Cargo.toml version" step
• Extracted .github/workflows/build-native-matrix.yml as a workflow_call reusable workflow with an optional version input (the Cargo.toml sync step is skipped when unset)
• build-native.yml and publish.yml's build-native job now both call it instead of maintaining two copies

Why

Part of the broader CI/CD cost-reduction effort (#2108). Beyond the duplicated compute, the two copies had already started drifting (windows-latest here vs the pinned windows-2022 used in ci.yml's separate host-build matrix) — a single source of truth removes that risk for the target list, toolchain setup, and the macOS cargo-shim workaround.

Note: ci.yml's native-host-build/parity jobs are intentionally not folded into this — they build a different thing (3-OS host-native build + cargo test, no cross-compilation/musl/arm64 variants) for a different purpose (JS test + WASM/native parity validation), not distributable platform binaries.

Closes #2110

Test plan

• YAML parses for all three files
• actionlint — no new findings (pre-existing shellcheck notes only, all outside the touched regions)
• Next PR touching crates/** should confirm build-native.yml still produces artifacts named native-<platform> as before
• Next Publish run (dev or release) should confirm build-native job still produces the same artifacts with the version-synced Cargo.toml

[greptile-apps]

Greptile Summary

This PR extracts the shared 6-target cross-compilation matrix into a new build-native-matrix.yml reusable workflow, eliminating duplication between build-native.yml (PR validation) and publish.yml's build-native job (release builds). The optional version input controls whether the Cargo.toml version-sync step runs, keeping both callers in sync from a single source of truth.

• New reusable workflow (build-native-matrix.yml): defines the full 6-target matrix, the Rust/Node toolchain setup, macOS cargo-shim workaround, cross-compilation tooling, and artifact upload.
• build-native.yml and publish.yml: both simplified to a single uses: call.
• The refactor unifies windows-latest across both callers and standardises the artifact upload step name.

Confidence Score: 5/5

Safe to merge — this is a mechanical extraction of two near-identical inline job definitions into a single reusable workflow, with no logic changes to the build steps themselves.

All six matrix targets, toolchain setup steps, cross-compilation tooling, the macOS cargo-shim workaround, and artifact upload names are faithfully reproduced in the reusable workflow.

No files require special attention; the new build-native-matrix.yml is the only substantive change and faithfully mirrors the logic that was previously duplicated.

Important Files Changed

Filename	Overview
.github/workflows/build-native-matrix.yml	New reusable workflow consolidating the 6-target cross-compilation matrix; the optional version input correctly gates the Cargo.toml sync step, and artifact names are preserved as native-<artifact_key>.
.github/workflows/build-native.yml	Simplified to a single uses: call with permissions: contents: read; no version input passed, so the Cargo.toml sync step is correctly skipped for PR validation builds.
.github/workflows/publish.yml	build-native job replaced with a uses: call passing version from compute-version; downstream jobs that needs: build-native and download native-linux-x64 artifacts remain unaffected since artifact names are identical.

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into fix/consolidate..." | Re-trigger Greptile}

[carlos-alm]

@greptileai