Check shipped libraries against the Frame; keep OpenSSL out of the bundle (iteration 2, step 7)

package-release.sh refuses a package whose ELF files need newer glibc or
OpenSSL symbol versions than the Frame has (D35); only the version needs
section counts. The Qt bundler resolved libmosquitto's dependencies and
shipped Debian's OpenSSL 3.5; libssl/libcrypto are now excluded, since
SteamOS provides OpenSSL 3. Phase 3 of iteration 2 is done; PROGRESS.md
has the manual checklist for phase 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DESIGN.md

@@ -514,6 +514,12 @@ excluded from the Qt bundler, licence in `share/doc/frameassistant/`).
    of MQTT (D17).
 6. Guard: `package-release.sh` checks with `readelf -V` that shipped libraries need no newer
    symbol versions than the Frame has (today at most `OPENSSL_3.2`, `GLIBC_2.39`).
+   Implemented for every ELF file in the package, reading only the version *needs* section
+   (a library's own definitions, e.g. libssl's `OPENSSL_3.5.0`, gave false positives).
+7. Found when building the bundled package: the bundler resolves dependencies recursively,
+   also through excluded libraries, and shipped Debian's `libssl`/`libcrypto` (OpenSSL 3.5)
+   for libmosquitto. `cmake/Mosquitto.cmake` now excludes them too: OpenSSL comes from
+   SteamOS (3.2.1; libmosquitto needs `OPENSSL_3.0.0`).
 
 ## Test strategy