feat: publish ARM64 musl bindings

[nflaig]

What changed

• add aarch64-unknown-linux-musl to the Lodestar-Z native package target matrix
• pin hashtree-z to the merged PIC-enabled commit from ChainSafe/hashtree-z#12
• pin the Zig ZAPI dependency to the ARM64-musl backport on zapi-v2.x.0
• keep the npm dependency on @chainsafe/zapi 2.0.0, apply the matching target-support backport with a pnpm patch, and bundle the patched dependency for consumers

Why

Lodestar currently receives an ARM64 musl binary from @chainsafe/blst. Replacing it with Lodestar-Z without an equivalent artifact would regress Alpine Linux support on ARM64.

The first real cross-build also exposed non-PIC objects in hashtree-z, which prevented the native Node.js shared library from linking. The pinned prerequisite commit fixes that linker failure.

Dependency chain

• ChainSafe/zapi#47 is backported to zapi-v2.x.0
• ChainSafe/hashtree-z#12 is merged; build.zig.zon pins its canonical squash commit using zig fetch --save=hashtree

Validation

• complete aarch64-unknown-linux-musl ReleaseSafe build through the patched ZAPI 2 CLI
• native host ReleaseSafe bindings build
• frozen pnpm install
• pnpm lint
• zig fmt --check build.zig.zon
• 236 binding tests passed
• npm package dry run confirms the patched ZAPI 2 dependency is bundled

This PR was written with AI assistance.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4fcb93f5d7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update ZAPI before adding the ARM64 musl target

Adding this entry makes the publish workflow parse zapi.targets with the declared @chainsafe/zapi dependency (pnpm zapi build-artifacts in .github/workflows/publish-bindings.yml), but package.json/pnpm-lock.yaml still pin @chainsafe/zapi to 2.0.0. That version's config parser only accepts its built-in target list, which does not include aarch64-unknown-linux-musl, so the release job will fail with Unsupported target before it can publish any bindings; runtime loading also keeps using the old requireNapiLibrary mapping. Please bump @chainsafe/zapi and the lockfile to the release containing ChainSafe/zapi#47 in the same change.

Useful? React with 👍 / 👎.

[nflaig]

LGTM, thanks Cayman for fixing up the branch properly