Attach a static linux/arm64 seid binary to releases - #4004

Well-executed arm64 arch-split: the per-arch libgcc pin (checksums verified against the vendored files), the ELF-machine guards in build-static.sh / boot-smoke.sh / goreleaser-shim.sh, and the new hook-executability check all fail closed, and both prior review findings are genuinely fixed. Two non-blocking notes: the newly-added digest print can't support the cross-run comparison its comment claims, and the fail-fast hook check runs after the slow build.