[codex] prove Linux glibc 2.31 compatibility

[TheGreenCedar]

Context

Linux release archives were built and executed only on the current hosted Ubuntu image. The published v0.14.3 Linux x64 archive fails on Ubuntu 20.04 with missing GLIBC_2.32 through GLIBC_2.39 and GLIBCXX_3.4.29/3.4.30, so cross-compilation and current-runner smoke did not establish an older-userspace floor.

Closes #1037
Refs #921

What Changed

• build Linux x64 in a digest-pinned Rust 1.95.0 Debian Bullseye container at glibc 2.31
• execute the packaged archive in a digest-pinned Ubuntu 20.04 container at glibc 2.31
• exercise packaged version, help, and MCP stdio initialize while retaining stdout, stderr, and exit codes
• enforce the build/runtime image pins and PR path coverage in workflow policy
• document glibc 2.31 as the Linux x64 floor without claiming musl or Linux arm64 compatibility

How To Review

1. Confirm the Linux x64 matrix build runs inside the pinned Bullseye image while other native matrix rows remain unchanged.
2. Confirm the baseline probe extracts the archive and runs only the packaged executable.
3. Confirm every probe retains diagnostics before asserting success.
4. Confirm the docs preserve the explicit musl and arm64 non-claims.

Verification

• bash -n .github/scripts/check-linux-glibc-baseline.sh
• node .github/scripts/check-workflow-policy.mjs
• node .github/scripts/check-doc-links.mjs
• git diff --check
• verified both pinned containers report glibc 2.31; the build image reports Rust/Cargo 1.95.0
• exercised the harness against published v0.14.3 and observed the expected fail-closed loader diagnostics on glibc 2.31
• no local Cargo run; Persist parser source snapshots and reject changed-during-parse results #978 owns the serialized Cargo slot and the native packaged matrix is the required executable proof

Risk

The main remaining risk is that a dependency may require an additional build package absent from the pinned Bullseye image. The PR's Linux x64 packaged matrix is intentionally the acceptance gate for that build and for actual glibc 2.31 execution. This does not establish a Linux arm64 or musl baseline.