ci: fix musl static-PIE link + macOS x86_64 cross-wheel smoke test

Two follow-ups surfaced by the re-tagged v2.3.7 run:

- musl native link failed with 'read-only segment has dynamic
  relocations' on .svm_heap. The musl.cc gcc 11 toolchain defaults to
  static-PIE, which GraalVM's image heap can't satisfy. Add
  -H:NativeLinkerOption=-no-pie for the musl build to force a non-PIE
  static executable. (The earlier musl.cc download fix worked; this is
  the next error it exposed.)

- macOS x86_64 wheel built fine but its smoke test failed: the runner's
  arm64 Python can't install an x86_64-tagged wheel. Run that leg's
  smoke test under Rosetta via the universal /usr/bin/python3 so the
  venv, pip install, and bundled binary are all x86_64.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: rahlk

.github/workflows/release-pypi.yml

@@ -219,11 +219,23 @@ jobs:
           ls -l "$PWD/dist"
 
       - name: Smoke test wheel
+        if: matrix.rosetta != true
         shell: bash
         env:
           PYTHON: ${{ runner.os == 'Linux' && '/opt/python/cp312-cp312/bin/python' || 'python3' }}
         run: bash .github/scripts/smoke-test.sh dist
 
+      # The cross-built x86_64 wheel can't be installed by the runner's arm64
+      # Python. Run the whole smoke test under Rosetta with the universal
+      # /usr/bin/python3, so the venv, pip install, and bundled native binary
+      # all execute as x86_64.
+      - name: Smoke test wheel (x86_64 via Rosetta)
+        if: matrix.rosetta
+        shell: bash
+        env:
+          PYTHON: /usr/bin/python3
+        run: arch -x86_64 bash .github/scripts/smoke-test.sh dist
+
       - name: Checksums (log only)
         shell: bash
         run: |

build.gradle

@@ -208,6 +208,12 @@ graalvmNative {
             if (System.getenv("CODEANALYZER_NATIVE_MUSL") == "true") {
                 buildArgs.add("--static")
                 buildArgs.add("--libc=musl")
+                // The musl.cc gcc 11 toolchain is built with
+                // --enable-default-pie/--enable-static-pie, so a plain `-static`
+                // link produces a static-PIE. The linker then rejects GraalVM's
+                // image heap ("read-only segment has dynamic relocations" on
+                // .svm_heap). Force a classic non-PIE static executable.
+                buildArgs.add("-H:NativeLinkerOption=-no-pie")
             }
             buildArgs.add("-H:ReflectionConfigurationFiles=$projectDir/src/main/resources/META-INF/native-image-config/reflect-config.json")
             buildArgs.add("-H:ResourceConfigurationFiles=$projectDir/src/main/resources/META-INF/native-image-config/resource-config.json")