Publish native Cosmos driver: cross-build matrix & CI pipeline (Big-5 + musl)

Part of the **Cosmos DB Go SDK v2 (`azcosmos/v2`)** effort. The Go v2 SDK links a native artifact built from the Rust Cosmos driver over a C ABI (decision: `Azure/azure-sdk-for-go#27238`, ADR `docs/adr/0001-go-v2-uses-ffi.md`). This issue stands up the **engineering system that builds and publishes that native artifact**. Self-contained; owners decide how to complete it.

**Scope**
- Build `azure_data_cosmos_driver_native` (depends on the Rust driver crate, exposes the C ABI, emits `azurecosmosdriver` as `cdylib` + `staticlib`, generates `include/azurecosmosdriver.h`) across the **Big-5 + musl** matrix: Windows amd64/arm64, Linux amd64/arm64 (glibc), macOS arm64, and Linux musl amd64/arm64 (Alpine).
- Lay out per-platform Go modules in the native-driver repo (`Azure/azure-cosmos-driver`) with build-tagged cgo LDFLAGS, and a per-target versioned tag scheme (`//vX.Y.Z`).
- Build with [`cargo-auditable`](https://github.com/rust-secure-code/cargo-auditable) so binaries carry an embedded dependency list.

**Prior art to reuse**
- Bootstrap window: `Azure/azure-cosmos-driver#5` (windows/amd64 manual module) and the Mac native-build prompt already produced by this crew.

**Deliverables**
- Reproducible CI producing per-target artifacts + headers.
- Per-target Go modules that cgo-link the artifact via build tags.
- Tagging/versioning scheme for consumers to `require`.

**Definition of done**
- A signed artifact for at least one target is consumed from a **scratch Go module** built purely from pipeline output (no local hand-build).

> Signing and supply-chain integrity are tracked as separate issues in this milestone.

Read docs/adr/0001-go-v2-uses-ffi.md and Azure/azure-cosmos-driver#5 first; inspect the existing windows/amd64 manual module and the Mac native-build prompt. Map the Rust driver's C ABI and cargo-auditable build across the stated targets, then connect the artifacts to per-target Go modules. Done means a scratch Go module consumes a signed pipeline-produced artifact for at least one target.

Written by the indexing model from the issue text.