cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce.

The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.

flake.nix

@@ -10,8 +10,8 @@
       # BEGIN GENERATED BY zig build cut
       version = "0.0.17";
       hashes = {
-        "aarch64-linux" = "sha256-BwWuS4OhtBTY+VbRQztHg8ZmlqRv2QioCt92NprBlrY=";
-        "x86_64-linux" = "sha256-hSgsXuLRcoOJvlcnuOuQ0ifS12i6gAmIVBFWMCopZQY=";
+        "aarch64-linux" = "sha256-tDnKVUlosx6NK5qLqUAPvIncJ+C7JZ1dNSa8QiEzPHc=";
+        "x86_64-linux" = "sha256-juCx8wse5DvLCgyOeJRp+seUUj4xRotUwZnQtXHIq2s=";
       };
       # END GENERATED BY zig build cut