autofix: No aarch64-unknown-linux-gnu build anywhere

.github/workflows/sdk-typescript-publish.yml

@@ -212,9 +212,67 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  build-linux-arm64:
+    name: build (aarch64-unknown-linux-gnu)
+    needs: verify-tag
+    runs-on: ubuntu-latest
+    # QEMU runs the arm64 node:20-bullseye container on the x86_64 host so we
+    # get a NATIVE compile inside the container (no cross-sysroot tricks).
+    # The resulting .node loads on every Linux with GLIBC >= 2.31:
+    # ARM64 Vercel sandbox, ARM64 RHEL 9, Amazon Linux 2/2023 (aarch64), etc.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU for arm64 containers
+        uses: docker/setup-qemu-action@v3
+
+      - name: Build native addon (linux arm64 gnu, native debian-bullseye via QEMU)
+        run: |
+          docker run --platform linux/arm64 \
+            -v ${{ github.workspace }}:/workspace \
+            -w /workspace/sdk/typescript \
+            node:20-bullseye \
+            bash -c '
+              set -e
+              apt-get update
+              apt-get install -y --no-install-recommends \
+                build-essential \
+                pkg-config \
+                ca-certificates \
+                curl \
+                unzip
+
+              PROTOC_VERSION=29.3
+              curl -fsSL "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-aarch_64.zip" -o /tmp/protoc.zip
+              unzip -o /tmp/protoc.zip -d /usr/local
+              chmod +x /usr/local/bin/protoc
+              protoc --version
+              ls /usr/local/include/google/protobuf/timestamp.proto
+
+              curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
+              export PATH="$HOME/.cargo/bin:$PATH"
+              rustc --version
+              cargo --version
+
+              npm ci
+              npm run build -- --target aarch64-unknown-linux-gnu
+
+              ls -lh codegraff-sdk.*.node
+              objdump -T codegraff-sdk.linux-arm64-gnu.node | grep GLIBC | sort -u | tail -10 || true
+            '
+
+      - name: Upload .node artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bindings-aarch64-unknown-linux-gnu
+          path: sdk/typescript/codegraff-sdk.*.node
+          if-no-files-found: error
+          retention-days: 7
+
   publish:
     name: publish to npm
-    needs: [verify-tag, build, build-linux]
+    needs: [verify-tag, build, build-linux, build-linux-arm64]
     runs-on: ubuntu-latest
     environment:
       name: npm-publish