fix(packaging): build pywhispercpp at the portable x86-64 baseline (#959)

* fix(packaging): build pywhispercpp at the portable x86-64 baseline

Every packaged channel shipped a libggml-cpu compiled for AVX2+FMA:
the manylinux PyPI wheel itself carries -mavx2 -mfma -mbmi2 code, so
any package that bundles it dies with SIGILL when whisper.cpp loads a
model on a pre-Haswell CPU (the reporter's i5-3337U). GGML_NATIVE=OFF
alone is not the portable baseline either; while the native default
is on, ggml turns every GGML_* SIMD option on, so each is pinned off.

- Snap: force the sdist (PIP_NO_BINARY) with the flag floor via
  CMAKE_ARGS in the part's build-environment.
- Flatpak: extend the module's CMAKE_ARGS with the same floor.
- Native .deb/.rpm: the build still vendors the wheels, then rebuilds
  libggml-cpu alone from the same hash-pinned sdist and swaps it into
  the vendored copies, asserting no AVX/FMA survives; the container
  image gains cmake, g++, make and binutils.
- AppImage: extract the pinned-sdist reinstall into a shared helper
  and route every CPU-only fallback of the Vulkan path through a new
  baseline rebuild at the same floor; the Vulkan compile keeps its
  own flags via the same helper. Keeping the wheel on those paths was
  the bug's exact binary.

Fixes #957

* style(tests): apply black/isort to the new packaging guards

* fix(native): keep the wheel's libggml providers, alias its base/gomp sonames

Swapping the whole libggml set for the baseline build broke the import
smoke: the wheel's auditwheel-mangled core lib doubles as the
extension's __cxa_call_terminate provider, and its NEEDED entries are
the mangled names. Swap only libggml-cpu, and satisfy the baseline
library's own unmangled NEEDEDs (libggml-base.so.0, libgomp.so.1) with
aliases of the vendored copies, which carry no generated SIMD and are
the same upstream version. Fail closed when the vendored set has
restructured instead of silently shipping the AVX2 wheel.

* fix(packaging): fail builds that lose the speech engine, unblock the ISA assert

Greptile findings on the baseline work:

- A failed baseline rebuild in the AppImage returned success after
  remove_appdir_pywhispercpp, so the bundle would ship with no speech
  engine at all while logging that the wheel was kept. Propagate the
  failure through every CPU-only fallback so the build stops instead.
- The native libggml-cpu assertion used grep -q under pipefail, where
  grep's early exit SIGPIPEs objdump and the pipeline reports a miss,
  letting an AVX2 library through. Read the full disassembly instead.

* fix(installer): build pywhispercpp from sdist on the CPU path

install_cpu_pywhispercpp let pip pick the manylinux wheel, whose
libggml-cpu is compiled for AVX2+FMA and SIGILLs on pre-Haswell CPUs
(#957). Pass --no-binary pywhispercpp like the Vulkan/CUDA paths so the
sdist compiles against this machine's own instruction set.

* fix(installer): install C++ toolchain on distros that ship without one

Forcing the pywhispercpp sdist on the CPU path needs a compiler, and the
fedora, mageia, alpine, void and solus package maps did not request one.
Add gcc-c++/make (rpm), build-base (alpine), base-devel (void) and
gcc/g++/make (solus) so source installs compile on minimal systems.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

tests/test_flatpak_packaging.py

@@ -28,6 +28,19 @@ from packaging.specifiers import SpecifierSet
 from packaging.utils import canonicalize_name
 from packaging.version import Version
 
+#: ggml SIMD options pinned off for the portable x86-64 baseline in every
+#: packaged pywhispercpp build (#957). GGML_NATIVE=OFF alone leaves each of
+#: these on while ggml's native default is on.
+PORTABLE_GGML_OPTIONS = (
+    "GGML_NATIVE",
+    "GGML_SSE42",
+    "GGML_AVX",
+    "GGML_AVX2",
+    "GGML_BMI2",
+    "GGML_FMA",
+    "GGML_F16C",
+)
+
 REPO_ROOT = Path(__file__).resolve().parents[1]
 PYPROJECT = REPO_ROOT / "pyproject.toml"
 EXPORT = REPO_ROOT / "requirements" / "runtime.txt"
@@ -221,8 +234,10 @@ def test_the_version_injection_names_the_version_being_built() -> None:
 def test_the_vulkan_build_does_not_borrow_the_builders_instruction_set() -> None:
     """GGML_NATIVE is ggml's default and puts -march=native on libggml-cpu, so
     the Flatpak inherits whichever instruction set the builder has, and the
-    result SIGILLs on any CPU without it (#938). OFF ships the portable
-    baseline the PyPI wheel carries."""
+    result SIGILLs on any CPU without it (#938). OFF alone is not the portable
+    baseline either: while the native default is on, ggml turns every GGML_*
+    SIMD option on, still compiling -mavx2 -mfma and dying on pre-Haswell CPUs
+    (#957), so each option must be pinned off for the plain x86-64 baseline."""
     module = re.search(
         r"^  - name: python3-pywhispercpp$(.*?)(?=^  - name: |\Z)",
         DEPS_YAML.read_text(encoding="utf-8"),
@@ -232,9 +247,13 @@ def test_the_vulkan_build_does_not_borrow_the_builders_instruction_set() -> None
     command_lines = [
         line for line in module.group(1).splitlines() if not line.lstrip().startswith("#")
     ]
-    assert any(
-        "-DGGML_NATIVE=OFF" in line and "pip3 install" in line for line in command_lines
-    ), "the Flatpak Vulkan build must not compile with -march=native"
+    install_line = next((line for line in command_lines if "pip3 install" in line), "")
+    assert install_line, "the pywhispercpp pip3 install line is gone"
+    for flag in PORTABLE_GGML_OPTIONS:
+        assert f"-D{flag}=OFF" in install_line, (
+            f"the Flatpak build does not pin {flag} off; the package runs on"
+            " CPUs the builder's instruction set does not describe"
+        )
 
 
 def test_the_manifest_env_agrees_with_the_module() -> None: