Record the aarch64 build path and its glibc ceiling

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013kj58Jugkic783b8ZrtTVZ

docs/REPOS.md

@@ -140,8 +140,34 @@ docs/BOM.md               only where the repo owns hardware
 Python floors at **3.10**, the Orin's version, for anything that might run there.
 The workstation has 3.14; do not rely on it.
 
-Rust binaries are built for `aarch64-unknown-linux-gnu`. `Cargo.lock` and
+`Cargo.lock` and `pubspec.lock` are committed — these are applications, not
-`pubspec.lock` are committed — these are applications, not libraries.
+libraries.
+
+#### Building for the Orin
+
+Services cross-compile from the workstation:
+
+```bash
+cargo build --release --target aarch64-unknown-linux-gnu
+```
+
+Each service repo's `.cargo/config.toml` points at `aarch64-linux-gnu-gcc`, from
+the `gcc-aarch64-linux-gnu` package.
+
+⚠ **The cross sysroot's glibc is newer than the Orin's** — 2.43 against 2.35 — and
+a binary cannot use a symbol version the target lacks. What matters is not the
+sysroot but the **highest version actually referenced**, currently 2.34, which is
+why the binaries run. The margin is one release.
+
+A dependency reaching for a newer symbol breaks this at **runtime**, on the car,
+as a loader error — the build succeeds. Check before deploying:
+
+```bash
+objdump -T <binary> | grep -o 'GLIBC_[0-9.]*' | sort -Vu | tail -1
+```
+
+At or below `GLIBC_2.35` it will run. Above it, build on the Orin or in a
+container matching its release.
 
 ### Writing style