cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce.

The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.

src/upstream/pool.zig

@@ -1951,11 +1951,9 @@ test "a waiter that spends its whole budget queueing blames nobody but the budge
     try testing.expectEqual(@as(usize, 2), fake.calls.load(.acquire));
 }
 
-/// The saturated-primary test's numbers. The holders stall longer than the
-/// probe's whole budget, so the probe provably cannot be waiting for one of
-/// their slots; the stall still ends inside the test so the holders' futures
-/// can be awaited rather than abandoned.
-const saturating_stall_ms = 800;
+/// The saturated-primary test's budgets. The holders do not stall on a clock at
+/// all: they are held on a gate the test releases, so the probe's own budget is
+/// the only duration the test depends on.
 const probe_attempt_ms = 150;
 const probe_total_ms = 300;
 
@@ -1968,10 +1966,11 @@ test "a saturated primary defers to a standby that has capacity" {
     // slow exchange, and the standby is idle. Priority orders the entries that
     // can be admitted now; it does not entitle a saturated entry to hold a
     // query until the whole budget is gone.
-    var primary: Fake = .{ .behavior = .{ .slow = .{
-        .duration = .{ .raw = .fromMilliseconds(saturating_stall_ms), .clock = .awake },
-        .reply = response_bytes,
-    } } };
+    // The holders are released by the test, not by a clock: a fixed stall can
+    // expire before a loaded scheduler lets the poller observe both calls, and
+    // an overlap that already passed cannot be recovered by polling.
+    var gate: std.Io.Semaphore = .{};
+    var primary: Fake = .{ .behavior = .{ .hold = .{ .gate = &gate, .reply = response_bytes } } };
     var standby: Fake = .{ .behavior = .{ .reply = alt_response_bytes } };
     var entries = [_]Entry{
         testEntrySlots("https://primary.example/dns-query", &primary, 10, 2),
@@ -1989,14 +1988,20 @@ test "a saturated primary defers to a standby that has capacity" {
 
     var bufs: [2][512]u8 = undefined;
     var holders: [2]std.Io.Future(transport.ExchangeError!Attributed) = undefined;
+    var spawned: usize = 0;
+    // Every spawned holder is released and awaited on any exit, including the
+    // skip when the second spawn is refused: a holder left blocked on the gate
+    // would outlive the stack it reads.
+    defer for (holders[0..spawned]) |*holder| {
+        _ = holder.await(io) catch Attributed.discarded;
+    };
+    defer for (0..spawned) |_| gate.post(io);
     for (&holders, &bufs) |*holder, *buf| {
         holder.* = io.concurrent(exchangeAttributed, .{ &holder_pool, io, buf }) catch |err| switch (err) {
             error.ConcurrencyUnavailable => return error.SkipZigTest,
         };
+        spawned += 1;
     }
-    defer for (&holders) |*holder| {
-        _ = holder.await(io) catch Attributed.discarded;
-    };
     // Both permits provably taken before the probe asks for one.
     try awaitInFlight(io, &primary, 2);