build: D1 cross-compile via cargo-zigbuild (4 non-macOS targets)

Replace the single-target musl cc with cargo-zigbuild + zig in the flake
devShell — one universal cross cc/linker (incl. rusqlite's bundled SQLite
C) for all four non-macOS D1 targets, added to rust-toolchain.toml:
  x86_64/aarch64-unknown-linux-musl              (static, D2)
  x86_64-pc-windows-gnu, aarch64-pc-windows-gnullvm  (standalone .exe)

Windows links -lsynchronization (std WaitOnAddress), which rust-overlay's
toolchain and zig's mingw don't ship; the symbols are forwarded by
kernel32, so an empty stub libsynchronization.a (ci/winstub/, wired via
.cargo/config.toml for the windows targets only) satisfies the linker.
Verified: all four build; linux static; windows valid PE32+.

rust-toolchain.toml

@@ -7,9 +7,15 @@ channel = "1.95.0"
 # rustfmt + clippy back the `fmt`/`clippy` CI stages; no coverage or WASM
 # tooling is needed here (pure-Rust TUI).
 components = ["rustfmt", "clippy"]
-# x86_64 musl for the static release binary (D2: single static binary, no
-# runtime deps). The glibc default links the host/nix-store glibc dynamically
-# and isn't portable; the musl target with crt-static produces a fully static
-# binary. Further D1 matrix targets (aarch64, windows-gnu, …) are added as the
-# release matrix expands, step by step.
-targets = ["x86_64-unknown-linux-musl"]
+# The non-macOS D1 release matrix, all cross-built from Linux x86_64 via
+# `cargo zigbuild` (D1: cross-platform binaries; D2: single static binary).
+# Linux uses musl + crt-static for fully static, portable binaries; Windows
+# uses the gnu/gnullvm ABIs (Zig statically links libc, so the .exe is
+# standalone). macOS is deferred — its arboard/AppKit link needs Apple's SDK,
+# which a Linux runner can't supply cleanly (see docs/ci/adr ADR-ci-001).
+targets = [
+  "x86_64-unknown-linux-musl",
+  "aarch64-unknown-linux-musl",
+  "x86_64-pc-windows-gnu",
+  "aarch64-pc-windows-gnullvm",
+]