Build hanzo-mcp for every target the installer offers

hanzo.sh offers `mcp` as a native download and names five published targets.
Nothing in this repository built any of them: hanzo.yml declares a TypeScript
gate, publish.yml ships the npm package, and the tarballs on the last release
covered Linux alone. On macOS the installer asked for a file nobody had built.

So this lane builds the Rust crate — the one whose Cargo.toml calls itself
hanzo-mcp — on the rust-v* tags it is already released under, and attaches each
tarball with the checksum the installer refuses to install without.

Both macOS targets build on the arm64 machine, because the Apple toolchain
cross-compiles to x86_64 without a second host.

fail-fast is off. One target failing leaves the others published, which is a
missing file somebody can chase; fail-fast leaves an empty release, which is an
install that breaks for everyone.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/release.yml

@@ -0,0 +1,83 @@
+# Builds the hanzo-mcp binary for every target the installer offers, and
+# attaches each with its checksum.
+#
+# There was no such lane. hanzo.yml declares a TypeScript gate and publish.yml
+# ships the npm package; neither produces a binary, so the tarballs on the
+# rust-v1.1.23 release arrived some other way and only ever covered Linux.
+# hanzo.sh offers `mcp` as a native download, so on macOS it asked for a file
+# nobody had built.
+#
+# Tagged rust-v*, because the binary is the Rust crate in rust/ — its
+# Cargo.toml is the one that calls itself hanzo-mcp.
+#
+# .github/workflows, because that is where this repository's pipelines already
+# live and what github.com resolves. The self-hosted pool is registered to the
+# hanzoai org on github.com, including the macOS arm64 machine this lane needs
+# — a caller under .hanzo/ would be a lane nothing schedules.
+name: release
+
+on:
+  push:
+    tags: ['rust-v*']
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    strategy:
+      # One target failing leaves the others published rather than the release
+      # empty. A missing target is a missing file somebody can chase; a missing
+      # release is an install that breaks for everyone.
+      fail-fast: false
+      matrix:
+        include:
+          - target: linux-amd64
+            on: linux-amd64
+            triple: x86_64-unknown-linux-gnu
+          - target: linux-arm64
+            on: hanzo-build-linux-arm64
+            triple: aarch64-unknown-linux-gnu
+          # Both macOS targets build on the arm64 machine: the Apple toolchain
+          # cross-compiles to x86_64 without a second host, which is why there
+          # is no Intel runner in this list and does not need to be.
+          - target: darwin-arm64
+            on: macos-arm64
+            triple: aarch64-apple-darwin
+          - target: darwin-amd64
+            on: macos-arm64
+            triple: x86_64-apple-darwin
+    runs-on: ${{ matrix.on }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        working-directory: rust
+        run: |
+          set -eu
+          rustup target add "${{ matrix.triple }}" 2>/dev/null || true
+          cargo build --release --locked --bin hanzo-mcp --target "${{ matrix.triple }}"
+
+      # The name the installer asks for, and the checksum it refuses to install
+      # without. Both are part of the contract in hanzo.sh, not decoration.
+      - name: Package
+        run: |
+          set -eu
+          asset="hanzo-mcp-${{ matrix.target }}.tar.gz"
+          tar -C "rust/target/${{ matrix.triple }}/release" -czf "$asset" hanzo-mcp
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "$asset" | cut -d' ' -f1 > "$asset.sha256"
+          else
+            shasum -a 256 "$asset" | cut -d' ' -f1 > "$asset.sha256"
+          fi
+          ls -l "$asset" "$asset.sha256"
+
+      - name: Attach
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF_NAME}" \
+            "hanzo-mcp-${{ matrix.target }}.tar.gz" \
+            "hanzo-mcp-${{ matrix.target }}.tar.gz.sha256" \
+            --clobber --repo "${GITHUB_REPOSITORY}"