Praxis mode 7/8: Release cortex-gateway as a standalone binary #1723

Part of #1714 · phase A, delivery step 7 · Section 4 (Release and install, A standalone binary) · design in #1717 (docs/superpowers/specs/2026-11-07-praxis-mode-design.md)

Goal

Ship cortex-gateway the way the Go binaries ship: standalone, with no system library to install.

Scope

• First: prove a static musl Linux build on rust:alpine, with static linking on. The native code (vendored OpenSSL, aws-lc-sys, zstd-sys, jemalloc) must link statically. cortex-cpex already does this for its Rust FFI.
• praxis/server turns on OpenSSL's vendored feature. Upstream Praxis links the system OpenSSL dynamically, so a plain build is not portable (measured: a stock macOS build needs Homebrew's libssl.4.dylib).
• Its own release job on native runners: darwin/arm64, linux/amd64, linux/arm64. A gateway build failure does not block the Go release.
• A release check that fails when the binary links OpenSSL dynamically (otool -L, ldd).
• A weekly job that builds against the latest Praxis release. It does not block, and it reports a failure.

Done when

• The three tarballs run on a clean host with no OpenSSL package: macOS, a glibc Linux and a musl Linux.
• A Go release succeeds even when the gateway job fails.

Depends on

#1719 and #1724. No release ships a gateway tarball before the MCP and A2A ports (#1724), so install.sh --praxis cannot opt in to a mode that loses MCP and A2A facts. New duty from this issue: Cortex owns OpenSSL security updates for the gateway (an openssl-src bump and a release per OpenSSL CVE).

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com