test(termux): isolate native Python linkage on an ARM runner

.github/workflows/termux-verify.yml

@@ -0,0 +1,64 @@
+name: Termux verification
+
+on:
+  push:
+    branches: [ethie/cli-bundles]
+    paths:
+      - 'scripts/termux/**'
+      - 'pm/**'
+      - 'tests/test_termux*'
+      - '.github/workflows/termux-verify.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: termux-verify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  native-linkage:
+    name: Reproduce and verify bionic Python linkage
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: '0.12.3'
+          enable-cache: false
+      - name: Stage the pinned bionic runtimes
+        run: |
+          bash scripts/termux/build_cpython.sh termux-build/payload
+          bash scripts/termux/build_uv.sh termux-build/payload
+          python3 scripts/termux/stage_runtime_libs.py termux-build/payload
+      - name: Run the native reproduction
+        run: |
+          image=ghcr.io/ethernet8023/hermes-termux-builder:c14ffb703abf
+          docker pull "$image"
+          image=$(docker image inspect --format '{{index .RepoDigests 0}}' "$image")
+          printf 'Builder image: %s\n' "$image"
+          mkdir -p termux-build/linkage
+          chmod 0777 termux-build/linkage
+          docker run --rm --platform linux/arm64 --user 1000:1000 \
+            -v "$PWD:/repo:ro" -v "$PWD/termux-build/payload:/payload:ro" \
+            -v "$PWD/termux-build/linkage:/evidence" \
+            "$image" bash -c '
+              set -euo pipefail
+              export PREFIX=/data/data/com.termux/files/usr
+              export LD_LIBRARY_PATH="/payload/python$PREFIX/lib:/payload/runtime-libs/lib:$PREFIX/lib"
+              exec "/payload/python$PREFIX/bin/python3.11" \
+                /repo/scripts/termux/probe_python_linkage.py \
+                --repo /repo --payload /payload --output /evidence
+            '
+      - name: Preserve the built wheel and linker evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: termux-linkage-${{ github.sha }}
+          path: termux-build/linkage/
+          if-no-files-found: warn
+          retention-days: 7