Migrate Windows arm64 release build to native windows-11-arm runner

Both windows-11-arm and windows-2025 GitHub-hosted runner images now ship
the same VC++/Windows SDK/LLVM toolchain, so the arm64 leg of the Windows
release build no longer needs to cross-compile from an x86_64 host.

- .github/workflows/create_release.yml: point the arm64 leg of
  build_windows_binaries and release_windows (already keyed by a
  per-arch matrix.runner) at windows-11-arm instead of
  windows-latest-large. Give build_windows_tui_binaries and
  release_windows_tui the same per-arch matrix.runner treatment (they
  previously had a flat runs-on: windows-latest-large). Drop the
  'Add arm64 target' rustup steps, since the arm64 leg's host target
  is now aarch64-pc-windows-msvc rather than a cross-compiled add-on.
  Disable azure/artifact-signing-action's dependency cache
  (cache-dependencies: false) in both signing steps, since it is not
  keyed by runner architecture and can otherwise be corrupted when the
  x64 and arm64 legs of the matrix sign concurrently
  (Azure/artifact-signing-action#146).
- script/install_cargo_binstall: pin the aarch64-pc-windows-msvc
  cargo-binstall archive and its verified SHA-256 alongside the
  existing x86_64 entry, so the installer can resolve a native arm64
  archive if it is ever selected.

Author: warp-agent-staging[bot]

.github/workflows/create_release.yml

@@ -1895,7 +1895,7 @@ jobs:
   # release_windows.
   build_windows_tui_binaries:
     name: Build Release Binary (Windows TUI ${{ matrix.arch }})
-    runs-on: windows-latest-large
+    runs-on: ${{ matrix.runner }}
     needs: prepare_release
     if: ${{ inputs.build_windows != false }}
     timeout-minutes: 150
@@ -1904,7 +1904,9 @@ jobs:
       matrix:
         include:
           - arch: x64
+            runner: windows-latest-large
           - arch: arm64
+            runner: windows-11-arm
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
@@ -1916,10 +1918,6 @@ jobs:
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
           ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
-      - name: Add arm64 target
-        if: ${{ matrix.arch == 'arm64' }}
-        run: rustup target add aarch64-pc-windows-msvc
-        shell: bash
 
       - name: Get channel configuration
         id: get-config
@@ -1947,7 +1945,7 @@ jobs:
 
   release_windows_tui:
     name: Build Release (Windows TUI ${{ matrix.arch }})
-    runs-on: windows-latest-large
+    runs-on: ${{ matrix.runner }}
     needs: [prepare_release, build_windows_binaries, build_windows_tui_binaries]
     if: ${{ inputs.build_windows != false }}
     timeout-minutes: 150
@@ -1957,8 +1955,10 @@ jobs:
         include:
           - arch: x64
             release_arch: x86_64
+            runner: windows-latest-large
           - arch: arm64
             release_arch: aarch64
+            runner: windows-11-arm
     env:
       TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/
       TRUSTED_SIGNING_ACCOUNT: warpdotdev
@@ -2024,6 +2024,10 @@ jobs:
           file-digest: SHA256
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
+          # The action's dependency cache is not keyed by runner architecture, so x64 and arm64
+          # legs of this matrix can clobber each other's cached tools when they run concurrently
+          # (Azure/artifact-signing-action#146).
+          cache-dependencies: false
       - name: Build sign-tool command for Inno Setup
         id: setup_signing
         shell: pwsh
@@ -2098,7 +2102,7 @@ jobs:
           - arch: x64
             runner: windows-latest-large
           - arch: arm64
-            runner: windows-latest-large
+            runner: windows-11-arm
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
@@ -2111,11 +2115,6 @@ jobs:
           install_release_deps: true
           ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
 
-      - name: Add arm64 target
-        if: ${{ matrix.arch == 'arm64' }}
-        run: rustup target add aarch64-pc-windows-msvc
-        shell: bash
-
       - name: Get channel configuration
         id: get-config
         uses: ./.github/actions/get_channel_config/
@@ -2173,7 +2172,7 @@ jobs:
           - arch: x64
             runner: windows-latest-large
           - arch: arm64
-            runner: windows-latest-large
+            runner: windows-11-arm
     env:
       TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/
       TRUSTED_SIGNING_ACCOUNT: warpdotdev
@@ -2236,6 +2235,10 @@ jobs:
           file-digest: SHA256
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
+          # The action's dependency cache is not keyed by runner architecture, so x64 and arm64
+          # legs of this matrix can clobber each other's cached tools when they run concurrently
+          # (Azure/artifact-signing-action#146).
+          cache-dependencies: false
 
       # The azure/artifact-signing-action above downloads signtool.exe and the Trusted Signing dlib.
       # We locate them so ISCC can call signtool during compilation to sign the inner setup engine

script/install_cargo_binstall

@@ -29,6 +29,8 @@ archive_sha256() {
             echo "c55962a0115f9716b709216de7f8bdd59d6ba8738779e60b051b4593f677717a" ;;
         cargo-binstall-x86_64-pc-windows-msvc.zip)
             echo "89706aa5215c164d8d091597a470fee72308ac87e8553af395ea77db844a888c" ;;
+        cargo-binstall-aarch64-pc-windows-msvc.zip)
+            echo "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418" ;;
     esac
 }