fix: unzip each artifact separately and verify both profile and stripped binaries

The build-bun step uploads both bun-{triplet}.zip and
bun-{triplet}-profile.zip. Previously 'unzip -o *.zip' failed because
unzip treated the second filename as a filter inside the first archive.

Now each zip is extracted individually into its own directory and both
binaries (bun and bun-profile) are verified under QEMU.

.buildkite/ci.mjs

@@ -537,6 +537,24 @@ function getLinkBunStep(platform, options) {
   };
 }
 
+/**
+ * Returns the artifact triplet for a platform, e.g. "bun-linux-aarch64" or "bun-linux-x64-musl-baseline".
+ * Matches the naming convention in cmake/targets/BuildBun.cmake.
+ * @param {Platform} platform
+ * @returns {string}
+ */
+function getTargetTriplet(platform) {
+  const { os, arch, abi, baseline } = platform;
+  let triplet = `bun-${os}-${arch}`;
+  if (abi === "musl") {
+    triplet += "-musl";
+  }
+  if (baseline) {
+    triplet += "-baseline";
+  }
+  return triplet;
+}
+
 /**
  * Returns true if a platform needs QEMU-based baseline CPU verification.
  * x64 baseline builds verify no AVX/AVX2 instructions snuck in.
@@ -570,9 +588,11 @@ function getVerifyBaselineStep(platform, options) {
     timeout_in_minutes: 5,
     command: [
       `buildkite-agent artifact download '*.zip' . --step ${targetKey}-build-bun`,
-      `unzip -o *.zip`,
-      `chmod +x bun`,
-      `./scripts/verify-baseline-cpu.sh --arch ${archArg} --binary ./bun`,
+      `unzip -o '${getTargetTriplet(platform)}.zip'`,
+      `unzip -o '${getTargetTriplet(platform)}-profile.zip'`,
+      `chmod +x ${getTargetTriplet(platform)}/bun ${getTargetTriplet(platform)}-profile/bun-profile`,
+      `./scripts/verify-baseline-cpu.sh --arch ${archArg} --binary ${getTargetTriplet(platform)}/bun`,
+      `./scripts/verify-baseline-cpu.sh --arch ${archArg} --binary ${getTargetTriplet(platform)}-profile/bun-profile`,
     ],
   };
 }