build: static musl release build capability

rust-toolchain.toml gains the x86_64-unknown-linux-musl target; the
flake devShell gains a musl cc (pkgsCross.musl64) + CC/linker env so a
`cargo build --target …-musl` compiles rusqlite's bundled SQLite C and
links fully static (D2: single static binary, no runtime deps). Cargo
release profile strips symbols (13MB -> 10MB). Verified locally: the
musl binary is static-pie, statically linked, stripped, runs standalone.

rust-toolchain.toml

@@ -5,6 +5,11 @@
 # flake's convention (its ADR 0046). Bump deliberately, in its own commit.
 channel = "1.95.0"
 # rustfmt + clippy back the `fmt`/`clippy` CI stages; no coverage or WASM
-# tooling is needed here (pure-Rust TUI). Cross-compilation targets for the
-# eventual D1 release matrix are added when that CI lands, not before.
+# tooling is needed here (pure-Rust TUI).
 components = ["rustfmt", "clippy"]
+# x86_64 musl for the static release binary (D2: single static binary, no
+# runtime deps). The glibc default links the host/nix-store glibc dynamically
+# and isn't portable; the musl target with crt-static produces a fully static
+# binary. Further D1 matrix targets (aarch64, windows-gnu, …) are added as the
+# release matrix expands, step by step.
+targets = ["x86_64-unknown-linux-musl"]