fix(ci): fix release-vm-dev pipeline failures

- Add CI container to download-kernel-runtime job so gh CLI is available
  (bare build-amd64 runner does not have gh installed)
- Fall back to plain cargo build in build-rootfs.sh when cargo-zigbuild
  is not available (works for native builds in CI where arch matches)

Author: drew

.github/workflows/release-vm-dev.yml

@@ -65,6 +65,11 @@ jobs:
     name: Download Kernel Runtime
     runs-on: build-amd64
     timeout-minutes: 10
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 

crates/openshell-vm/scripts/build-rootfs.sh

@@ -302,16 +302,18 @@ SUPERVISOR_TARGET="${RUST_TARGET}"
 SUPERVISOR_BIN="${PROJECT_ROOT}/target/${SUPERVISOR_TARGET}/release/openshell-sandbox"
 
 echo "==> Building openshell-sandbox supervisor binary (${SUPERVISOR_TARGET})..."
-if ! command -v cargo-zigbuild >/dev/null 2>&1; then
-    echo "ERROR: cargo-zigbuild is not installed."
-    echo "       Install it with: cargo install cargo-zigbuild"
-    echo "       Also requires: zig (brew install zig)"
-    exit 1
+if command -v cargo-zigbuild >/dev/null 2>&1; then
+    cargo zigbuild --release -p openshell-sandbox --target "${SUPERVISOR_TARGET}" \
+        --manifest-path "${PROJECT_ROOT}/Cargo.toml" 2>&1 | tail -5
+else
+    # Fallback: use plain cargo build when cargo-zigbuild is not available.
+    # This works for native builds (e.g. building x86_64 on x86_64) but
+    # will fail for true cross-compilation without a cross toolchain.
+    echo "    cargo-zigbuild not found, falling back to cargo build..."
+    cargo build --release -p openshell-sandbox --target "${SUPERVISOR_TARGET}" \
+        --manifest-path "${PROJECT_ROOT}/Cargo.toml" 2>&1 | tail -5
 fi
 
-cargo zigbuild --release -p openshell-sandbox --target "${SUPERVISOR_TARGET}" \
-    --manifest-path "${PROJECT_ROOT}/Cargo.toml" 2>&1 | tail -5
-
 if [ ! -f "${SUPERVISOR_BIN}" ]; then
     echo "ERROR: supervisor binary not found at ${SUPERVISOR_BIN}"
     exit 1