Pin Zig to a real release so the musl release build fetches reliably

The release run failed at "Install zig": mlugg/setup-zig, left unpinned, resolved
to the newest version it knew of — an unreleased 0.16.0 whose tarball 404s on
ziglang.org — and the community mirrors returned 502/503 around it, so the step
errored out before cargo-zigbuild ever ran.

Pin the action to Zig 0.14.1, an archived release with a permanent official
download URL. The official source then succeeds even when the mirrors are flaky,
and the version stays compatible with cargo-zigbuild. Also moves the action to
@v2.

Only the Linux musl jobs use zig; macOS and Windows are unaffected. Not run on a
real tag yet in this session.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -63,7 +63,15 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends cmake clang libclang-dev
       - name: Install zig
         if: matrix.zig
-        uses: mlugg/setup-zig@v1
+        uses: mlugg/setup-zig@v2
+        with:
+          # Pin a real, archived Zig release. Left unpinned the action resolves
+          # to the newest version it knows of (a yet-unreleased 0.16.0-dev here),
+          # whose tarball 404s on ziglang.org while the community mirrors flake —
+          # exactly the failure this build hit. A concrete release always has a
+          # permanent official URL, so the download succeeds even if mirrors are
+          # down, and the version stays compatible with cargo-zigbuild.
+          version: 0.14.1
       - name: Install cargo-zigbuild
         if: matrix.zig
         uses: taiki-e/install-action@v2