fix: harden npm distribution release and installer

- release.yml: build static musl Linux binaries (no host glibc
  requirement), add darwin-x64, publish SHA256SUMS, allow
  workflow_dispatch for an existing tag (v0.2.3 has no binaries yet),
  and run build-only on PRs that touch the workflow or installer
- install.js: verify downloads against the release SHA256SUMS
  (IDX_BINARY_SHA256 for overrides), add a 60s request timeout, use
  stream.pipeline so truncated downloads fail, and skip the download
  inside the source checkout
- idx.js: forward SIGTERM/SIGHUP to the binary and keep the signal
  exit status
- package.json: drop the prepare script (no Rust toolchain needed to
  pack/publish)
- npm-smoke.sh: read the tarball name from npm pack, use grep over rg
- .gitignore: ignore /bin/ and *.tgz
- docs: musl targets, checksums, pnpm/bun opt-in, manual release flow

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

.github/workflows/release.yml

@@ -4,10 +4,25 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to build and attach binaries to (for example v0.2.3)"
+        required: true
+  pull_request:
+    paths:
+      - ".github/workflows/release.yml"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "package.json"
+      - "scripts/install.js"
 
 permissions:
   contents: write
 
+env:
+  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+
 jobs:
   build:
     name: Build ${{ matrix.asset }}
@@ -17,38 +32,49 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
+            target: x86_64-unknown-linux-musl
             asset: linux-x64
-          - os: ubuntu-latest
-            target: aarch64-unknown-linux-gnu
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
             asset: linux-arm64
           - os: macos-14
             target: aarch64-apple-darwin
             asset: darwin-arm64
+          - os: macos-14
+            target: x86_64-apple-darwin
+            asset: darwin-x64
 
     steps:
       - name: Check out source
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
 
       - name: Install Rust toolchain and target
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
-      - name: Install Linux ARM64 linker
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
-        run: sudo apt-get update && sudo apt-get install --yes gcc-aarch64-linux-gnu
+      - name: Install musl toolchain
+        if: endsWith(matrix.target, '-linux-musl')
+        run: sudo apt-get update && sudo apt-get install --yes musl-tools
 
       - name: Build release binary
         shell: bash
         run: |
-          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
-            export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
+          target="${{ matrix.target }}"
+          if [[ "$target" == *-linux-musl ]]; then
+            # Bundled SQLite and ring compile C code; build it against musl too.
+            export "CC_${target//-/_}=musl-gcc"
           fi
-          cargo build --release --locked --target "${{ matrix.target }}"
+          cargo build --release --locked --target "$target"
           cp "target/${{ matrix.target }}/release/idx" "idx-${{ matrix.asset }}"
           chmod 0755 "idx-${{ matrix.asset }}"
 
+      - name: Check binary runs
+        if: matrix.target != 'x86_64-apple-darwin'
+        run: ./idx-${{ matrix.asset }} --help >/dev/null
+
       - name: Upload target artifact
         uses: actions/upload-artifact@v4
         with:
@@ -59,6 +85,7 @@ jobs:
   publish:
     name: Attach binaries to release
     needs: build
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - name: Download target artifacts
@@ -67,11 +94,16 @@ jobs:
           pattern: idx-*
           merge-multiple: true
 
+      - name: Write checksums
+        run: sha256sum idx-linux-x64 idx-linux-arm64 idx-darwin-arm64 idx-darwin-x64 > SHA256SUMS
+
       - name: Attach binaries to the version tag
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ github.ref_name }}
+          tag_name: ${{ env.RELEASE_TAG }}
           files: |
             idx-linux-x64
             idx-linux-arm64
             idx-darwin-arm64
+            idx-darwin-x64
+            SHA256SUMS