fix(ci): pin linux glibc floor for published binaries

[NathanFlurry]

Summary

• Pins linux-gnu published artifacts to Deno's bionic sysroot at link time instead of inheriting the runner glibc floor.
• Adds glibc symbol-floor guards and old-container smoke checks for sidecar, runtime-sidecar, and plugin Linux artifacts.
• Adds the syscall shims required by the sysroot link path.

Validation

• cargo check --workspace
• pnpm build
• pnpm check-types
• pnpm --filter publish test
• pnpm --filter publish check-types
• node scripts/verify-fixed-versions.mjs
• Lean preview publish: https://github.com/rivet-dev/agentos/actions/runs/28841480113
• Local npm smoke: @rivet-dev/agentos@glibc / 0.0.0-glibc.928bc3a installed and verified in Debian 11 and Ubuntu 20.04 containers

[railway-app]

🚅 Deployed to the agentos-pr-1647 environment in agentos

Service	Status	Web	Updated (UTC)
agentos	😴 Sleeping (View Logs)	Web	Jul 7, 2026 at 4:35 am

---

🚅 Environment agentos-pr-1647 in rivet-frontend has no services deployed.