feat: add static musl package and Forgejo release-static app

Lets deploy targets fetch a prebuilt binary instead of compiling bunshin
from source, which matters on low-power hosts like a single-CPU VPS.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,3 @@
+# Copy to .env (gitignored) and fill in. Used by `nix run .#release-static`.
+# Forgejo token with write:package scope, from Settings > Applications.
+FORGEJO_TOKEN=

.gitignore

@@ -5,3 +5,4 @@
 server.key
 result
 result-*
+.env

flake.nix

@@ -91,11 +91,50 @@
         packages.default = bunshin { };
         packages.rns = bunshin { rns = true; };
 
+        # Static musl build (no rns feature: microReticulum's cmake/C++
+        # build isn't set up for static linking). Lets a low-power deploy
+        # target (bucur) fetch a prebuilt binary instead of compiling —
+        # see apps.release-static.
+        packages.static = pkgs.pkgsStatic.rustPlatform.buildRustPackage {
+          pname = "bunshin";
+          version = "0.1.0";
+          src = ./.;
+          cargoLock.lockFile = ./Cargo.lock;
+          nativeBuildInputs = [ pkgs.pkgsStatic.pkg-config ];
+          buildInputs = [ pkgs.pkgsStatic.sqlite ];
+        };
+
         apps.default = flake-utils.lib.mkApp {
           drv = bunshin { };
           name = "bunshin";
         };
 
+        # Builds packages.static and uploads it to this repo owner's
+        # Forgejo generic package registry, tagged by short commit hash.
+        # Needs FORGEJO_TOKEN (a token with write:package scope) in the
+        # environment; run from a checkout so `git rev-parse` and the `.`
+        # flake ref resolve to the right place.
+        apps.release-static = flake-utils.lib.mkApp {
+          drv = pkgs.writeShellApplication {
+            name = "bunshin-release-static";
+            runtimeInputs = [ pkgs.nix pkgs.curl pkgs.git ];
+            text = ''
+              if [ -f .env ]; then
+                set -a
+                # shellcheck disable=SC1091
+                . ./.env
+                set +a
+              fi
+              rev=$(git rev-parse --short HEAD)
+              out=$(nix build .#static --no-link --print-out-paths)
+              : "''${FORGEJO_TOKEN:?set FORGEJO_TOKEN (env or .env) to a Forgejo token with write:package scope}"
+              url="https://code.randogoth.com/api/packages/randogoth/generic/bunshin/$rev/bunshin"
+              curl -sSf -H "Authorization: token ''${FORGEJO_TOKEN}" --upload-file "$out/bin/bunshin" "$url"
+              echo "uploaded: $url"
+            '';
+          };
+        };
+
         devShells.default = pkgs.mkShell {
           packages = with pkgs; [ cargo rustc rustfmt clippy pkg-config gcc sqlite cmake ninja ];
           env = rnsSourceEnv;