fix(packaging): build pywhispercpp at the portable x86-64 baseline (#959)

* fix(packaging): build pywhispercpp at the portable x86-64 baseline

Every packaged channel shipped a libggml-cpu compiled for AVX2+FMA:
the manylinux PyPI wheel itself carries -mavx2 -mfma -mbmi2 code, so
any package that bundles it dies with SIGILL when whisper.cpp loads a
model on a pre-Haswell CPU (the reporter's i5-3337U). GGML_NATIVE=OFF
alone is not the portable baseline either; while the native default
is on, ggml turns every GGML_* SIMD option on, so each is pinned off.

- Snap: force the sdist (PIP_NO_BINARY) with the flag floor via
  CMAKE_ARGS in the part's build-environment.
- Flatpak: extend the module's CMAKE_ARGS with the same floor.
- Native .deb/.rpm: the build still vendors the wheels, then rebuilds
  libggml-cpu alone from the same hash-pinned sdist and swaps it into
  the vendored copies, asserting no AVX/FMA survives; the container
  image gains cmake, g++, make and binutils.
- AppImage: extract the pinned-sdist reinstall into a shared helper
  and route every CPU-only fallback of the Vulkan path through a new
  baseline rebuild at the same floor; the Vulkan compile keeps its
  own flags via the same helper. Keeping the wheel on those paths was
  the bug's exact binary.

Fixes #957

* style(tests): apply black/isort to the new packaging guards

* fix(native): keep the wheel's libggml providers, alias its base/gomp sonames

Swapping the whole libggml set for the baseline build broke the import
smoke: the wheel's auditwheel-mangled core lib doubles as the
extension's __cxa_call_terminate provider, and its NEEDED entries are
the mangled names. Swap only libggml-cpu, and satisfy the baseline
library's own unmangled NEEDEDs (libggml-base.so.0, libgomp.so.1) with
aliases of the vendored copies, which carry no generated SIMD and are
the same upstream version. Fail closed when the vendored set has
restructured instead of silently shipping the AVX2 wheel.

* fix(packaging): fail builds that lose the speech engine, unblock the ISA assert

Greptile findings on the baseline work:

- A failed baseline rebuild in the AppImage returned success after
  remove_appdir_pywhispercpp, so the bundle would ship with no speech
  engine at all while logging that the wheel was kept. Propagate the
  failure through every CPU-only fallback so the build stops instead.
- The native libggml-cpu assertion used grep -q under pipefail, where
  grep's early exit SIGPIPEs objdump and the pipeline reports a miss,
  letting an AVX2 library through. Read the full disassembly instead.

* fix(installer): build pywhispercpp from sdist on the CPU path

install_cpu_pywhispercpp let pip pick the manylinux wheel, whose
libggml-cpu is compiled for AVX2+FMA and SIGILLs on pre-Haswell CPUs
(#957). Pass --no-binary pywhispercpp like the Vulkan/CUDA paths so the
sdist compiles against this machine's own instruction set.

* fix(installer): install C++ toolchain on distros that ship without one

Forcing the pywhispercpp sdist on the CPU path needs a compiler, and the
fedora, mageia, alpine, void and solus package maps did not request one.
Add gcc-c++/make (rpm), build-base (alpine), base-devel (void) and
gcc/g++/make (solus) so source installs compile on minimal systems.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

tests/test_native_packaging.py

@@ -338,3 +338,46 @@ def test_pipeline_gates_the_packages() -> None:
     for distro in re.findall(r"- (\S+)", matrix.group(1)):
         family = distro.split(":")[0].split("/")[-1]
         assert family in smoke, f"smoke-test.sh has no recipe for {distro}"
+
+
+#: ggml SIMD options pinned off for the portable x86-64 baseline in every
+#: packaged pywhispercpp build (#957). GGML_NATIVE=OFF alone leaves each of
+#: these on while ggml's native default is on.
+PORTABLE_GGML_OPTIONS = (
+    "GGML_NATIVE",
+    "GGML_SSE42",
+    "GGML_AVX",
+    "GGML_AVX2",
+    "GGML_BMI2",
+    "GGML_FMA",
+    "GGML_F16C",
+)
+
+
+def test_vendored_libggml_cpu_is_rebuilt_at_the_portable_baseline() -> None:
+    """The pinned pywhispercpp wheels build.sh vendors carry a libggml-cpu
+    compiled for AVX2+FMA, which dies with SIGILL at model load on pre-Haswell
+    CPUs (#957). The package must rebuild just that library from the same
+    pinned sdist at the plain x86-64 baseline and swap it into the vendored
+    copies; without a toolchain in the container image that build cannot run."""
+    build = BUILD_SH.read_text(encoding="utf-8")
+    assert (
+        "--no-binary pywhispercpp" in build
+    ), "the baseline libggml-cpu must come from the hash-pinned sdist, not a wheel"
+    command_lines = [line for line in build.splitlines() if not line.lstrip().startswith("#")]
+    cmake_args = "\n".join(
+        line for line in command_lines if "-DGGML_" in line or "cmake -S" in line
+    )
+    for flag in PORTABLE_GGML_OPTIONS:
+        assert (
+            f"-D{flag}=OFF" in cmake_args
+        ), f"the vendored libggml-cpu rebuild does not pin {flag} off"
+    assert "libggml-cpu" in build and "find" in build, (
+        "the rebuild must swap into the vendored copies in place so the"
+        " wheels' NEEDED entries still resolve"
+    )
+    container = CONTAINER_BUILD_SH.read_text(encoding="utf-8")
+    for tool in ("cmake", "g++", "binutils"):
+        assert (
+            tool in container
+        ), f"container-build.sh installs no {tool}; the baseline rebuild fails"