Check shipped libraries against the Frame; keep OpenSSL out of the bundle (iteration 2, step 7)

package-release.sh refuses a package whose ELF files need newer glibc or
OpenSSL symbol versions than the Frame has (D35); only the version needs
section counts. The Qt bundler resolved libmosquitto's dependencies and
shipped Debian's OpenSSL 3.5; libssl/libcrypto are now excluded, since
SteamOS provides OpenSSL 3. Phase 3 of iteration 2 is done; PROGRESS.md
has the manual checklist for phase 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/package-release.sh

@@ -50,6 +50,29 @@ cp -a "$stage/." "$out/"
 find "$out/bin" -maxdepth 1 -type f -perm -u+x ! -name "$exe" -delete
 cp "$root/LICENSE" "$out/"
 
+# Nothing shipped may need newer glibc or OpenSSL symbol versions than the Frame has
+# (docs/DESIGN.md, D35; checked on the Frame 2026-10-05: glibc 2.39, OpenSSL 3.2.1). Catches a
+# Debian update of a shipped library (libmosquitto, bundled Qt) that SteamOS can't run.
+frame_max=(GLIBC_2.39 OPENSSL_3.2.0)
+too_new=0
+while IFS= read -r -d '' file; do
+    [[ "$(file -b "$file")" == ELF* ]] || continue
+    # Only the "needs" section: a library's own version definitions (e.g. libssl defining
+    # OPENSSL_3.5.0) are not needed from the system.
+    for needed in $(readelf -V --wide "$file" |
+                    awk '/^Version needs section/ {n = 1; next} /^Version/ {n = 0} n' |
+                    grep -oE "Name: (GLIBC|OPENSSL)_[0-9.]+" | cut -d' ' -f2 | sort -u); do
+        for max in "${frame_max[@]}"; do
+            [[ "${max%%_*}" == "${needed%%_*}" ]] || continue
+            if [[ "$(printf '%s\n%s\n' "$needed" "$max" | sort -V | tail -1)" != "$max" ]]; then
+                echo "${file#"$out"/} needs $needed; the Frame has at most $max" >&2
+                too_new=1
+            fi
+        done
+    done
+done < <(find "$out" -type f -print0)
+(( too_new )) && { echo "Package not usable on the Frame" >&2; exit 1; }
+
 cat > "$out/install.sh" <<EOF
 #!/bin/sh
 # Installs or updates $name: registers it with SteamVR (starts automatically with