ci(release): build the Binding RC Linux wheel and addon with maturin and napi (#1618)

[DecisionNerd]

Sub-issue of #1618 (ADR 0048). It implements decision item 4 for release candidates.

Problem

binding-release-candidate.yml builds the Linux Python wheel and the Linux Node addon with native_builder: bazel, via scripts/ci/binding_rc_bazel_native.py. macOS and Windows already use maturin and napi.

Scope

1. Switch the Linux Python and Node matrix entries to maturin and napi, keeping the existing wheel tag (cp310-abi3-manylinux_2_17_x86_64) and the addon's target triple.
2. Remove the Bazel install and native-build steps, and retire binding_rc_bazel_native.py and assemble_bazel_binding_packages.py along with their tests.
3. Update tools/bazel/release/release_platforms.json consumers, or retire them if Bazel is their only consumer.

Acceptance criteria

• A Binding RC dispatch on the PR head produces Linux wheel and addon artifacts with the same tag and platform metadata as the last Bazel-built RC. Compare the wheel WHEEL metadata and the addon's package.json / .node target.
• Binding RC contains no Bazel step.

[DecisionNerd]

Binding RC qualification is complete: dispatch36655614470 passed all eight targets, aggregate and release assembly/offline rehearsal. The dispatch workflow head is 307631419d7a8aa35a011000bd6e67f502c4eff6; its unchanged current-main guard certified native source 471c16ff01daa1b6d76f3e654d59796d8fc096c8. These are separate identities. git diff --name-only 471c16ff HEAD -- Cargo.toml Cargo.lock pnpm-lock.yaml crates packages .cargo pyproject.toml package.json in the isolated PR checkout returns no differences. This is qualification of the PR workflow with guarded main native inputs, not publication certification for a later merged source.

Independent artifact inspection (zipfile WHEEL/METADATA parsing, readelf --version-info/ELF headers, native Node version(), tar package/loader/native SHA checks) confirms the actual Linux wheel/addon outcomes below. The old Bazel dispatch36638329649 failed before retaining final npm partitions, so no old assembled package is invented: new Linux x64 package metadata matches the unchanged declaration/target (@curatelabs/graphforge-linux-x64-gnu, 0.5.2, linux/x64/glibc, graphforge.linux-x64-gnu.node). Both native ELF targets are AMD64 Linux GNU. The new tar contains the exact tested addon and loaders by digest.

The Python cp310-abi3-manylinux_2_17_x86_64 platform is retained with maturin's equivalent manylinux2014_x86_64 alias. Package Name/Version/Requires-Python/Requires-Dist are identical. The old wheel linked GLIBC2.39 despite its 2.17 label; the new wheel's maximum is2.16. Node's glibc floor remains2.39, and native version() changes from incorrect0.0.0 to0.5.2. Both old wheel/addon hashes match their old report; both new hashes match the passed aggregate.

The offline receipt reports passed Python clean consumption, Node native loading through the main package, CLI/skills clean consumption, all20 Rust packages,29 candidate nodes and53 Rust dependency edges; offline=true and registry_writes=0. No registry publication occurred.

Binding RC contains no build-system step from the retired backend. Shared assembler/parity/build-tree retirement is already owned by existing native blocker #1646; #1618 remains the canonical close gate until that removal and #1643 are merged.

Downloaded artifact comparison and digests

{
  "workflow_run": 36655614470,
  "workflow_head": "307631419d7a8aa35a011000bd6e67f502c4eff6",
  "certified_source": "471c16ff01daa1b6d76f3e654d59796d8fc096c8",
  "aggregate_status": "passed",
  "targets": 8,
  "linux_wheels": {
    "bazel": {
      "name": "graphforge-0.5.2-cp310-abi3-manylinux_2_17_x86_64.whl",
      "sha256": "2d62fbf564defa9ad4a3a29068ab96fb6e4ce7f6691bd212a8c2b116ba7cf5cf",
      "tags": [
        "cp310-abi3-manylinux_2_17_x86_64"
      ],
      "metadata": {
        "Name": [
          "graphforge"
        ],
        "Version": [
          "0.5.2"
        ],
        "Requires-Python": [
          ">=3.10"
        ],
        "Requires-Dist": [
          "pyarrow>=14",
          "polars>=0.20 ; extra == 'polars'"
        ]
      },
      "highest_glibc": "2.39"
    },
    "maturin": {
      "name": "graphforge-0.5.2-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
      "sha256": "61baf449d08cda77ca9f8d5f5180b383d499044f448646aeaff7594d79e2e410",
      "tags": [
        "cp310-abi3-manylinux_2_17_x86_64",
        "cp310-abi3-manylinux2014_x86_64"
      ],
      "metadata": {
        "Name": [
          "graphforge"
        ],
        "Version": [
          "0.5.2"
        ],
        "Requires-Python": [
          ">=3.10"
        ],
        "Requires-Dist": [
          "pyarrow>=14",
          "polars>=0.20 ; extra == 'polars'"
        ]
      },
      "highest_glibc": "2.16"
    }
  },
  "linux_addons": {
    "bazel": {
      "name": "graphforge.linux-x64-gnu.node",
      "version": "0.0.0",
      "machine": "Advanced Micro Devices X86-64",
      "highest_glibc": "2.39",
      "sha256": "5c95921bce98bfd6fc837851f65450d8e5a510a6dfe2f66694a42f0939bb8e15"
    },
    "napi": {
      "name": "graphforge.linux-x64-gnu.node",
      "version": "0.5.2",
      "machine": "Advanced Micro Devices X86-64",
      "highest_glibc": "2.39",
      "sha256": "4baeea741eca9114be608ee3c849d4d1a5e34541a1d363a9e4bb96add0fd8e94"
    }
  },
  "loaders": {
    "index.js": "4f51f87b4bbdda6f59b9c1fa929d60984b53d8f5d15d94e4c698106c5d010632",
    "index.d.ts": "70b86718cab9a2ab28b3c23ac90c33a3dd5683e194316eca9ad3ce573879752e"
  }
}

[DecisionNerd]

Post-merge evidence for acceptance criterion 1: Binding RC run 36658527263 on dc9c27ea (the #1651 merge) concluded success. All nine build lanes and the aggregate passed, and no Bazel step ran.

Checked on the downloaded artifacts:

Artifact	Before (Bazel RC, run 36638329649)	After (this run)
Linux wheel file	graphforge-0.5.2-cp310-abi3-manylinux_2_17_x86_64.whl	graphforge-0.5.2-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
WHEEL tags	cp310-abi3-manylinux_2_17_x86_64	cp310-abi3-manylinux_2_17_x86_64, cp310-abi3-manylinux2014_x86_64 (the same platform)
Highest glibc symbol in _graphforge_rs.abi3.so	GLIBC_2.39 (the tag did not hold)	GLIBC_2.16 (the tag holds)
Linux x64 addon version()	0.0.0	0.5.2
Linux x64 addon highest glibc symbol	GLIBC_2.39	GLIBC_2.39 (unchanged)

The workflow's tag step logged wheel_tag=cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64. The Node loaders came from the tested lane as binding-rc-node-loaders-36658527263.

Still open, and outside this issue: the Linux x64 Node addon needs glibc 2.39 under both builds, while the aarch64 addon needs 2.17.