Linux arm64 and both macOS architectures join x86_64 Linux. Each leg
builds natively — there is no cross toolchain — so `matrix.target` is a
claim about the runner rather than something cargo enforces, and the job
asserts `rustc -vV`'s host against it before spending twenty minutes on
RocksDB. That check is not theoretical: `macos-13` was the last image
where the bare label meant Intel, and Intel is now `macos-15-intel`.

Publishing moves out of the matrix. Four legs each calling `gh release
create` would race to create one release; instead every leg uploads an
artifact and a single job collects all four, so a failed target blocks
the release rather than yielding a partial one. `--latest` is now passed
explicitly, because that pointer is what `releases/latest/download/`
resolves through and GitHub would otherwise pick it by date — which
would silently re-point every documented install URL if an older tag
were ever re-published.

macOS needs none of the static-libstdc++ work: libc++ is in the dyld
shared cache on every Mac. Its portability risk is a path rather than a
symbol version, so the dependency check there rejects anything from
outside /usr/lib and /System/Library instead of enumerating an
allowlist, and MACOSX_DEPLOYMENT_TARGET is pinned so the floor does not
move when GitHub rolls the image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015deaF2p9gvFi1oADaYEmfC