fix(ci): build x64 releases for baseline CPUs

[ybtam]

Summary

• Compile the Linux x64 CLI and paste service with bun-linux-x64-baseline.
• Add a bounded QEMU Nehalem gate to the existing Linux release smoke job for CLI --help, exact --version, and paste-service startup.
• Preserve asset names, checksums, provenance, installers, the Bun pin, and other platform targets.

Motivation

The official v0.27.14 Linux x64 CLI exits with SIGILL on an Ivy Bridge Xeon E3-1220 V2 and QEMU Nehalem. Explicit baseline builds start successfully. Bun 1.3.14's executable documentation recommends baseline for pre-2013 CPUs.

Validation

• Rebuilt review/hook UI and both Linux x64 executables with pinned Bun 1.3.14.
• Native Ivy Bridge CLI help and exact plannotator 0.27.14 version passed.
• Exact workflow smoke passed under QEMU 10.2.1 Nehalem; incompatible CLI/paste binaries and a version mismatch were rejected. A non-exiting real server was stopped at 60 seconds (exit 124).
• Installer/version tests: 126 passed, 8 PowerShell-dependent skips. Release-evidence tests: 4 passed.
• Actionlint 1.7.12 with ShellCheck 0.11.0, shell syntax checks, workflow scope assertions, and git diff --check passed.

Limitations

Remote CI is pending. Paste coverage verifies startup after Bun.serve, without HTTP or persistence checks. Emulation covers bounded startup, and performance was not benchmarked.