fix(ci): force musl linking for the static native binary

binary-type=STATIC alone picks glibc on Ubuntu jammy hosts, hence
the GLIBC_2.35 error at runtime. Explicitly force musl:

- -Dquarkus.native.libc=musl
- -Dquarkus.native.additional-build-args=--libc=musl
- delete target/*-runner first so we don't reuse a previously-built
  glibc-based binary that the Quarkus plugin cache might return

Verify step now exits 1 if the binary isn't statically linked, so
the next CI run tells us definitively whether we shipped static.

.gitea/workflows/ci.yml

@@ -62,14 +62,27 @@ jobs:
           restore-keys: ${{ runner.os }}-node-
 
       - name: Build (Native)
-        run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
+        run: |
+          rm -f target/shot-crafter-calculator-1.0.0-runner
+          mvn package -Pnative -B -DskipTests \
+            -Dquarkus.native.native-image-xmx=4g \
+            -Dquarkus.native.binary-type=STATIC \
+            -Dquarkus.native.libc=musl \
+            -Dquarkus.native.additional-build-args=--libc=musl
 
       - name: Verify native binary
         run: |
           ls -la target/shot-crafter-calculator-1.0.0-runner
           echo ""
           echo "=== Library dependencies ==="
-          ldd target/shot-crafter-calculator-1.0.0-runner 2>&1 || echo "(not a dynamic executable -> static)"
+          out=$(ldd target/shot-crafter-calculator-1.0.0-runner 2>&1 || true)
+          if echo "$out" | grep -q "not a dynamic executable"; then
+            echo "OK: binary is statically linked."
+          else
+            echo "FAIL: binary has dynamic dependencies:"
+            echo "$out"
+            exit 1
+          fi
 
       - name: Stage binary for Docker
         run: |