ci: D1 release matrix over the four non-macOS targets

release.yaml becomes test (once, host) -> build (matrix) over the four
cargo-zigbuild targets; each matrix job uploads its binary + .sha256 to
the shared release (idempotent create-or-get). Records the expansion in
ADR-ci-001 (2026-06-13 amendment); macOS stays deferred.

docs/ci/adr/20260612-adr-ci-001.md

@@ -24,6 +24,35 @@ it rather than restating it.
 > previously forced website ADRs to be renumbered (see that namespace's
 > history note and ADR-0000 "Numbering discipline").
 
+## Amendment — 2026-06-13: D1 matrix expanded (non-macOS targets)
+
+The release now builds the **four non-macOS D1 targets**, all cross-compiled
+from the Linux x86_64 runner with **`cargo-zigbuild`** (Zig's bundled clang +
+libc as one universal cross cc/linker — including the `cc`-crate compile of
+rusqlite's bundled SQLite C — added to the flake devShell, replacing the
+single-target musl cc):
+
+- `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl` — static (D2);
+- `x86_64-pc-windows-gnu`, `aarch64-pc-windows-gnullvm` — standalone `.exe`.
+
+`release.yaml` became a **`test` (once, host) → `build` (matrix over the four
+targets)** workflow; each matrix job uploads its artifact + `.sha256` to the
+shared release (idempotent create-or-get).
+
+**Windows link fix:** Rust's std links `-lsynchronization` (WaitOnAddress
+thread-parking), an import lib that rust-overlay's toolchain doesn't ship and
+Zig's mingw lacks. Those symbols are forwarded by `kernel32` (already linked),
+so an **empty stub** `libsynchronization.a` (committed at `ci/winstub/`, wired
+via `.cargo/config.toml` for the Windows targets only) satisfies the linker.
+Verified locally: all four build; the Linux binaries are statically linked; the
+Windows artifacts are valid PE32+ (x86-64 / Aarch64) — not yet runtime
+smoke-tested on Windows.
+
+**macOS stays deferred** (see Deferred): `arboard`→AppKit needs Apple's SDK,
+which a Linux runner can't supply cleanly — and the CI image is *public*, so the
+SDK can't be baked in even if the licensing grey area were accepted. macOS is
+its own step (osxcross + a private SDK, or a real Mac runner).
+
 ## Context
 
 The project is near feature-complete and needs CI (`requirements.md` **TT5**;
@@ -162,8 +191,9 @@ iteration ships **Linux x86_64 only**; the rest is deferred (below).
 
 ## Deferred / out of scope (tracked, step by step)
 
-- **D1 matrix:** aarch64, macOS, Windows builds (cross toolchains; macOS is the
-  hard part on a Linux runner).
+- **D1 matrix:** **macOS only** now (x86_64 + aarch64). The four non-macOS
+  targets shipped via cargo-zigbuild (see the 2026-06-13 amendment); macOS needs
+  Apple's SDK (osxcross + private SDK, or a Mac runner).
 - **D3 packaging:** Homebrew / Scoop / winget / `cargo-binstall` manifests
   (and binstall-friendly asset naming/archives).
 - **Tier 4 (PTY E2E):** still unwired (`requirements.md` **TT4**); the gate runs