ci: build musl targets with cargo instead of cross

upload-rust-binary-action reaches for `cross` on any *-musl target. Every
entry in the matrix builds on a runner of its own architecture — only the
libc differs — so cross buys nothing, and on the native arm64 runner it
hard-failed:

    error: toolchain 'stable-x86_64-unknown-linux-gnu' may not be able to
    run on this system

That cost v6.0.0 its aarch64-unknown-linux-musl archive; the other five
targets uploaded because the matrix is fail-fast: false.

Re-running the failed job from the Actions UI replays the old workflow file,
which is useless when the workflow is the bug. So the Release workflow now
takes an optional `tag` input that rebuilds and re-uploads binaries for an
existing tag. That value reaches actions/checkout as `ref:` and is typed by
whoever dispatches, so it is checked against a literal version tag first.

.github/workflows/release.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: [master]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to rebuild binaries for (e.g. v6.0.0). Leave empty for a normal release run.'
+        required: false
+        type: string
 
 permissions:
   contents: write
@@ -68,16 +73,25 @@ jobs:
       # string on the runs where nothing was released, and fromJSON chokes on it.
       - name: Resolve tag
         id: tag
-        if: steps.release-plz.outputs.releases_created == 'true'
+        if: steps.release-plz.outputs.releases_created == 'true' || inputs.tag != ''
         env:
           RELEASES: ${{ steps.release-plz.outputs.releases }}
-        run: echo "tag=$(jq -r '.[0].tag' <<< "$RELEASES")" >> "$GITHUB_OUTPUT"
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          tag="${INPUT_TAG:-$(jq -r '.[0].tag' <<< "$RELEASES")}"
+          # This value is handed to actions/checkout as `ref:` and INPUT_TAG is
+          # attacker-shaped (anyone who can dispatch the workflow types it), so
+          # refuse anything that is not a literal version tag.
+          [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || { echo "::error::unexpected tag: $tag"; exit 1; }
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
-  # Attaches downloadable binaries to the release GitHub just created.
+  # Attaches downloadable binaries to the release GitHub just created, or to an
+  # existing tag when dispatched manually with `tag` (recovering a target that
+  # failed to upload needs a re-run of *this* file, not the old one).
   binaries:
     name: ${{ matrix.target }}
     needs: release
-    if: needs.release.outputs.created == 'true'
+    if: needs.release.outputs.created == 'true' || inputs.tag != ''
     runs-on: ${{ matrix.os }}
     strategy:
       # One flaky cross-linker must not hold back the five targets that built.
@@ -111,10 +125,17 @@ jobs:
 
       # Builds, strips, archives (.tar.gz / .zip on Windows), writes a .sha256
       # and uploads the lot to the release.
+      #
+      # build-tool is pinned to cargo because the action otherwise reaches for
+      # `cross` on any *-musl target. Every entry in the matrix builds on a
+      # runner of its own architecture — only the libc differs — so cross adds
+      # nothing, and on the native arm64 runner it hard-fails trying to install
+      # an x86_64 toolchain.
       - uses: taiki-e/upload-rust-binary-action@v1
         with:
           bin: soulseek-rs
           target: ${{ matrix.target }}
+          build-tool: cargo
           archive: $bin-$tag-$target
           include: README.md,LICENSE
           checksum: sha256