Check shipped libraries against the Frame; keep OpenSSL out of the bundle (iteration 2, step 7)

package-release.sh refuses a package whose ELF files need newer glibc or
OpenSSL symbol versions than the Frame has (D35); only the version needs
section counts. The Qt bundler resolved libmosquitto's dependencies and
shipped Debian's OpenSSL 3.5; libssl/libcrypto are now excluded, since
SteamOS provides OpenSSL 3. Phase 3 of iteration 2 is done; PROGRESS.md
has the manual checklist for phase 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -275,11 +275,18 @@ hides world surfaces itself. Keep the teardown rule: overlays, then SteamVR, the
     targets, and with a `/usr` Qt it would bundle glibc.
 - **`VRDASH_BUNDLE_EXCLUDE` must keep excluding the GPU/display stack** (libGL/EGL/GLX,
   libdrm/gbm, Vulkan, Wayland, X11/xcb, libffi, glibc, libstdc++). These must come from SteamOS,
-  or GPU access breaks.
+  or GPU access breaks. With libmosquitto shipped, `cmake/Mosquitto.cmake` also excludes
+  `libssl`/`libcrypto`: the bundler resolves dependencies recursively (also through excluded
+  libraries) and otherwise ships Debian's OpenSSL 3.5; SteamOS has OpenSSL 3.
 - **Release packages** (`scripts/package-release.sh [--bundle-qt]`) contain only the
   app, `install.sh` (install/update: stops a running instance, registers,
-  launches), `uninstall.sh` and `README.txt`. `deploy-to-frame.sh` rsyncs the newest one to
-  the Frame and runs its `install.sh`.
+  launches), `uninstall.sh` (stops the app, `--ha-remove`, unregisters) and `README.txt`.
+  `deploy-to-frame.sh` rsyncs the newest one to the Frame and runs its `install.sh`.
+  - `package-release.sh` refuses a package whose ELF files *need* (version needs section, not
+    a library's own definitions) newer `GLIBC_*`/`OPENSSL_*` versions than the Frame has
+    (glibc 2.39, OpenSSL 3.2.1; D35). Raise the limits in the script only after checking the
+    Frame.
+  - About 11 of the binary's 12 MB are debug info (`RelWithDebInfo`).
 - **Licenses:** MIT (`LICENSE`); `THIRD_PARTY_NOTICES.md` and OpenVR's license are installed to
   `share/doc/frameassistant/`. Bundled builds also get the Debian copyright files of every bundled
   library plus the referenced common license texts (collected via `dpkg -S` in
@@ -355,3 +362,6 @@ Check these when testing on the device, and update this list:
 - Several dashboard tabs from one process (works in `tst_surfaces`, not tried in SteamVR).
 - Settings errors when started by SteamVR: the app exits and the log names the error (e.g.
   missing `device.name`); covered by `tst_config` off the device (iteration 1 checks 3, 4).
+- Iteration 2: the package with libmosquitto (system Qt and bundled) connects to the broker;
+  "Quit app" publishes `offline` (graceful exit); `uninstall.sh` removes the device from HA;
+  which CA store OpenSSL uses with `mqtt.tls.ca_file` empty.