ci(test): raise test thread stack size to avoid debug-build overflow

Unoptimized test binaries use far more stack per frame than release
builds, and deep paths (bounded JSON decode, in-process server tests)
can exceed the default 2 MiB thread stack, especially on aarch64.

Merge pull request #205 from NodeDB-Lab/fix/purge-teardown-and-cluste…

…r-harness-superuser

Fix cluster harness superuser identity and single-node tenant teardown storage reclaim

fix(ci): broaden internal dep pinning regex to cover bare nodedb crate

The explicit allowlist used in the prerelease pinning step omitted the
bare `nodedb` crate (and any future crates like `nodedb-vector-gpu`),
so for tags like `v0.3.0-beta.1` those deps stayed at `version = "0.3"`
(`^0.3`), which Cargo cannot resolve against a prerelease. This broke
both `publish-crates` and `build-server` jobs whenever a workspace
member declared `nodedb = "^0.3"`.

Replace the explicit crate-name alternation with a generic
`nodedb[a-z0-9-]*` pattern in both jobs so every internal nodedb*
path-dep is pinned to the exact prerelease version, and newly-added
crates are covered automatically without updating the regex.

fix(ci): broaden internal dep pinning regex to cover bare nodedb crate

The explicit allowlist used in the prerelease pinning step omitted the
bare `nodedb` crate (and any future crates like `nodedb-vector-gpu`),
so for tags like `v0.3.0-beta.1` those deps stayed at `version = "0.3"`
(`^0.3`), which Cargo cannot resolve against a prerelease. This broke
both `publish-crates` and `build-server` jobs whenever a workspace
member declared `nodedb = "^0.3"`.

Replace the explicit crate-name alternation with a generic
`nodedb[a-z0-9-]*` pattern in both jobs so every internal nodedb*
path-dep is pinned to the exact prerelease version, and newly-added
crates are covered automatically without updating the regex.

fix(deps): update rkyv to 0.8.16 (RUSTSEC-2026-0122)

Addresses a use-after-free vulnerability in rkyv caused by missing panic
safety in InlineVec::clear and SerVec::clear.

fix(ci): correct crate publish tier ordering in release workflow

nodedb-mem and nodedb-bridge depend on crates published in earlier tiers
and must wait for crates.io to index those before publishing. Moving them
to tier 3 (after nodedb-types) and shifting downstream crates accordingly
prevents publish failures caused by unresolved dependencies.

fix(build): statically link zlib to eliminate libz.so.1 runtime depen…

…dency

The release binary pulled in libz.so.1 dynamically through rdkafka-sys
and other transitive C dependencies. Minimal base images (Chainguard
glibc-dynamic, distroless) don't ship libz, causing the server to fail
at startup with a missing shared library error.

Force libz-sys to its `static` feature via Cargo's dependency
unification so zlib is compiled into the binary. The Dockerfile COPY
workaround that patched in a Debian-built libz at image build time is
removed. Documentation updated to reflect the [server.tls] config
section path. Workspace version bumped to 0.1.1.

fix(ci): skip isolated verify build in cargo publish

The `cargo publish --verify` step builds the package in an isolated
sandbox where workspace `[patch.crates-io]` overrides are not applied.
Transitive dependencies therefore resolve to upstream crates.io versions
rather than the patched forks used in the workspace, causing the verify
build to fail even when the real build is clean.

`--no-verify` skips this sandbox build; correctness is already proven
by the full workspace CI build that runs before publish.

chore(deps): bump wasmtime to 44

fix(ci): replace pipe-to-head with --max-count to avoid SIGPIPE under…

… pipefail

Using `git log ... | head -n 25` causes SIGPIPE when head closes the pipe
early, which fails the Discord notification step under `set -o pipefail`.
Switching to `--max-count=25` avoids the pipe entirely.