feat: NativeAOT builds, benchmarks and packaging

[solrevdev]

Summary

This PR ships ytx as NativeAOT binaries alongside the NuGet tool. It also keeps the investigation from #4 in the repo: the write-up, benchmarks, scripts, CI and packaging templates.

Status: based on master and up to date with 1.2.0, which adds chapters (#16, #17). #3 is done, so this is the next piece of work. Merge it when you decide to ship native binaries.

Refs #4.

What's in it

• src/Ytx/Ytx.csproj: InvariantGlobalization and CopyOutputSymbolsToPublishDirectory=false, applied only when PublishAot=true. The NuGet tool package is unchanged.
• .github/workflows/native.yml: builds osx-arm64, osx-x64, linux-x64 (on Ubuntu 22.04, glibc 2.34) and linux-arm64, plus win-x64, and smoke-tests each binary. For a release tag it uploads ytx-X.Y.Z-<rid>.tar.gz/.zip plus SHA256SUMS. Actions are pinned to SHAs.
• Release trigger: after each release, publish.yml runs gh workflow run native.yml --ref master -f tag=…. This is needed because releases created with GITHUB_TOKEN don't fire release: published. The publish job gains actions: write for this.
• README "Native binaries" section (new):
  • A table comparing the NuGet tool with the native binary.
  • When to choose native: CI and containers, many short calls, minimal machines, experimenting.
  • Checksum-verified install steps for macOS (including the Gatekeeper and quarantine note), Linux (glibc 2.34+, OpenSSL and CA certificates) and Windows (PowerShell, SmartScreen note).
  • A GitHub Actions step.
  • How to build a native binary yourself.
• scripts/aot/: publish, benchmark and smoke-test scripts. The smoke test covers the 1.1.0 usage errors and a refused --proxy connection.
• benchmarks/Ytx.Benchmarks/: a BenchmarkDotNet project. CI never builds it.
• docs/investigations/: the AOT write-up. The index now also lists the 1.1.0 write-up.
• packaging/: Homebrew and Scoop templates. These are not published.

Verified

The first checks ran on the stack before 1.1.0. The last one was re-checked after merging 1.2.0.

• AOT build: the osx-arm64 binary is 10.6 MB, with no trim or AOT warnings.
• Output: AOT and JIT output is byte-identical, with the same exit codes, in 7 live modes.
• Smoke test: all 15 checks pass.
• CI: all five platforms built and passed the smoke test.
• After merging 1.2.0: the osx-arm64 AOT binary has no warnings and passes the smoke test with 1.2.0. Its -c and -f md output for NYFGCESmikA, which has 23 chapters, is byte-identical to the 1.2.0 tool installed from NuGet.

CI runs again on this push.

Decisions for the next loop

• Ship it? Merge this, and the next release attaches binaries automatically. Use [skip ci] and a manual run if you want to choose the version number.
• Homebrew tap and Scoop bucket. These need solrevdev/homebrew-tap, a Scoop bucket repo and a fine-grained PAT. Note the name clash with koguchic/ytx (ytx-cli).
• More platforms: win-arm64 and linux-musl.
• Code signing or notarisation for macOS and Windows.
• A possible 2.0 using .NET 10's RID-specific tool package.

Before merging

native.yml must already be on master before the dispatch step can find it. That is true once this PR merges. The first release that attaches binaries is the one after this merge. Until then, the README install steps point at releases that don't yet have the assets.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb