Repair ARM64 Linux release builds

[isty2e]

Summary

• invoke Linux renameat2 through SYS_renameat2 instead of linking the optional glibc wrapper symbol
• run the no-replace move contract tests on Linux and macOS in addition to Windows
• add a focused ARM64 Linux release cross-build workflow for source, dependency, and release-workflow changes
• upgrade release artifact actions to their Node.js 24 majors

Root cause

The v0.4.0 aarch64-unknown-linux-gnu release job compiled successfully but failed at link time because the cross image's glibc did not export renameat2. Calling the kernel syscall directly preserves RENAME_NOREPLACE semantics without requiring that wrapper symbol.

Compatibility

The public CLI and JSON protocol are unchanged. Linux still fails rather than falling back to a non-atomic check-then-rename when renameat2 is unavailable.

Validation

• cargo test --locked --bin identedit rename_file_no_replace_ (2 passed on Linux)
• cargo fmt --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked
• cargo build --locked --release
• actionlint across every workflow

The new GitHub-hosted ARM64 Linux job is the acceptance gate for the cross-link failure.