Build the aarch64 wheel on a native arm64 runner

[jtdub]

Summary

Closes: DNE

The v4.0.0b4 release published no artifacts. Its linux (aarch64) job failed, fail-fast cancelled linux (x86_64), and the release job never ran.

Cause

• maturin-action picks its container from the host architecture. On an x64 host, target aarch64 cross-compiles in rust-cross/manylinux2014-cross:aarch64, whose toolchain is GCC 4.8.5.
• libmimalloc-sys 0.1.49 build.rs:45 passes -Wno-error=date-time on every non-Windows target. It uses flag(), not flag_if_supported(). GCC knows -Wdate-time only from 4.9, so cc1 errors.
• mimalloc arrived with Rust rewrite #302. Releases b1 and b3 predate the wheel-building workflow, so b4 was the first release to reach that image.
• 0.1.49 is the newest libmimalloc-sys on crates.io. No upstream fix exists.

I probed each candidate image with Docker:

Image	Compiler	-Wno-error=date-time
rust-cross/manylinux2014-cross:x86_64	GCC 11.4.0	OK
rust-cross/manylinux2014-cross:aarch64	GCC 4.8.5	fails
rust-cross/manylinux_2_28-cross:aarch64	GCC 7.5.0	OK
pypa/manylinux2014_aarch64	GCC 10.2.1	OK

Release workflow

• linux gains a runner matrix. aarch64 moves to ubuntu-24.04-arm, so maturin-action selects pypa/manylinux2014_aarch64. The glibc 2.17 floor is unchanged.
• Rejected manylinux: 2_28. It builds, but it raises the floor to glibc 2.28 and drops CentOS 7 and Amazon Linux 2.
• fail-fast: false on the linux, windows, musllinux and macos matrices. One broken target now reports its own result instead of hiding the others.
• actions/upload-artifact v4 to v7 and actions/download-artifact v4 to v8, off the deprecated Node 20 runtime. Every input in use still exists. v8 also turns an artifact digest mismatch into an error.

Pull request workflow

• New manylinux-wheels job. It mirrors the release linux matrix. The packaging job builds with the runner's own compiler and never enters a manylinux container, so the release was the first place the release toolchain ran.

After merge

Re-run the deploy workflow for the v4.0.0b4 tag. --skip-existing protects the upload step.

Test plan

Gate	Result
./scripts/build.py lint	pass, "No issues found"
./scripts/build.py pytest --coverage	1358 passed, 96.85% (floor 95)
mkdocs build --strict	pass
cargo fmt --check	pass
cargo clippy --locked --all-targets --all-features -- -D warnings	pass
cargo llvm-cov -p hier_config_core --fail-under-lines 90	97.74% lines
cargo test --locked --workspace --all-features	hier_config_core passes; see below

cargo test -p hier_config --lib aborts on my machine. The linker picks an x86_64 Homebrew libpython3.13.dylib on an arm64 host, so dyld cannot resolve _PyBool_Type. I reproduced the same abort against unmodified next, so it is environmental and not from this change. CI runs the crate on clean runners.

ubuntu-24.04-arm is already proven here: rust-tests (ubuntu-24.04-arm) and packaging (ubuntu-24.04-arm) pass on next.

Self-Review Checklist

• uv run --no-sync ./scripts/build.py lint-and-test passes locally (lint + 95% test coverage).
• The release extension was rebuilt with uv run --no-sync maturin develop --release --locked; Cargo formatting, Clippy, tests, and native coverage (95%) pass. — No Rust changed, so the extension was not rebuilt. Formatting, Clippy and native coverage pass; cargo test on the PyO3 crate aborts for the environmental reason above.
• Tests were written first (TDD) and cover the change. — This change has no library code. The new manylinux-wheels job is the regression guard: it fails on the pre-fix workflow and passes after it.
• CHANGELOG.md has an entry under ## [Unreleased] referencing this issue/PR ((#NNN)).
• Documentation is updated if public API or driver behavior changed (and mkdocs build --strict passes if docs were touched). — No public API or driver behavior changed; mkdocs build --strict passes.
• Commit messages follow the contributing guide: imperative mood, subject ≤72 characters, body explains why.

AI-Assisted Contributions

Written with Claude Code and reviewed with the hier-config-review skill.