zig-overlay

Add exposing Zig builds from Homebrew official binary bottles. These bottles carry macOS-specific patches that the upstream ziglang.org tarballs do not include. This includes a script to update but I'll just do this manually for new Zig releases since its infrequent and I don't fully trust the script.

fix to execute and set narrow package to the current system and require for nightly packages too add to the dev shell because the update script now computes hashes locally rewrite to use a temp dir, fail fast on fetch errors, retry downloads, verify release-only tarballs per platform, and derive from verified artifacts preserve historical nightly entries while replacing current release and master metadata so stale nested attrs cannot leak forward expand CI to build and run Zig, smoke test both templates, and check that only changes and tighten the auto-update workflow with scoped staging, no-op commit skipping, write permissions, and concurrency protection update the init and compiler-dev templates to use newer , reuse the exported overlay, and refresh the compiler-dev lockfile

The versioned index.json (signed via minisig) is a snapshot tied to the current master nightly and does not include newly tagged releases like 0.16.0. Previously, the script only used this versioned index, so new stable releases were never picked up. The main index.json at ziglang.org/download includes both releases and master, but is not itself signed. However, every individual tarball has a .minisig signature. For new tagged releases that only appear in the main index, the script now downloads and verifies all tarballs for supported targets against Zig's public key. Only verified releases are merged into the output. Master data continues to come exclusively from the signed versioned index. If any signature check fails, the script falls back to the verified index only.