Pin runners for glibc compatibility

Signed-off-by: Daniel Guns <danbguns@gmail.com>

Author: dgunzy

.claude/CHANGELOG.md

@@ -9,6 +9,42 @@ The format is based on the regulated environment requirements:
 
 ---
 
+## [2026-04-17] - Bump rustls-webpki to 0.103.12 (RUSTSEC-2026-0098, RUSTSEC-2026-0099)
+
+**Author:** Daniel Guns
+
+### Changed
+- `Cargo.lock`: Updated transitive dependency `rustls-webpki` from `0.103.11` to `0.103.12`
+
+### Why
+Two CVEs published 2026-04-14 in `rustls-webpki 0.103.11`: URI name constraint bypass (RUSTSEC-2026-0098) and wildcard name constraint bypass (RUSTSEC-2026-0099). Both are reachable via `kube-client` → `rustls` → `rustls-webpki`. Detected by `cargo audit` in CI.
+
+### Impact
+- [ ] Breaking change
+- [ ] Requires cluster rollout
+- [ ] Config change only
+- [x] Dependency bump — `Cargo.lock` only, no API changes
+
+---
+
+## [2026-04-17] - Pin CI build runners to ubuntu-22.04 to fix GLIBC_2.39 crash
+
+**Author:** Daniel Guns
+
+### Changed
+- `.github/workflows/build.yaml`: Pinned Linux x86_64 runner from `ubuntu-latest` to `ubuntu-22.04` and Linux ARM64 runner from `ubuntu-24.04-arm` to `ubuntu-22.04-arm`
+
+### Why
+`ubuntu-latest` now resolves to Ubuntu 24.04 (glibc 2.39). The resulting binaries require `GLIBC_2.39` at runtime, but the production base image `gcr.io/distroless/cc-debian12:nonroot` only provides glibc 2.36, causing a hard crash at container startup. Ubuntu 22.04 (glibc 2.35) is forward-compatible with Debian 12's glibc 2.36. Fixes issue #17.
+
+### Impact
+- [ ] Breaking change
+- [ ] Requires cluster rollout
+- [ ] Config change only
+- [x] CI/build change — no code changes
+
+---
+
 ## [2026-04-10 08:50] - Extend Cosign image signing to main-branch pushes
 
 **Author:** Erick Bourgeois

.github/workflows/build.yaml

@@ -185,11 +185,11 @@ jobs:
       matrix:
         platform:
           - name: Linux x86_64
-            runner: ubuntu-latest
+            runner: ubuntu-22.04
             artifact_name: 5spot-linux-amd64
             binary_name: 5spot
           - name: Linux ARM64
-            runner: ubuntu-24.04-arm
+            runner: ubuntu-22.04-arm
             artifact_name: 5spot-linux-arm64
             binary_name: 5spot
     steps: