Guard Linux speech runtime dependency closure and relocatable lookup

docs/LINUX-SPEECH-0.1.6.md

@@ -26,3 +26,28 @@ Snapshot: `/home/karl/.cache/searchi-validation/linux-source-9bc7221`.
 This closes a client portability check only. It does not prove the Linux native
 speech worker, model setup, runtime packaging, recognition quality, desktop UI
 or GPU operation. Published Linux downloads remain version 0.1.4.
+
+## Native runtime preparation
+
+A normal auto runtime build from that immutable snapshot is running in
+`/home/karl/.cache/searchi-validation/speech-auto-016`; it includes Vulkan
+compilation and does not run GPU inference. Do not restart it merely because
+an observation times out. Its full compilation and relocation remain unchecked.
+
+Inspection exposed an unverified release path: speech packaging flattened shared
+libraries without checking ELF dependency closure or their build-tree lookup
+paths. The builder now checks every staged ELF for origin-only RUNPATH and
+declared dependencies, allowing a system Vulkan loader only for the dynamic
+Vulkan module. Three builder tests passed, including rejection of build-tree
+paths, missing libraries and a Vulkan dependency on the CPU worker.
+
+The CMake configuration now gives Linux shared targets their own `$ORIGIN`
+RUNPATH; this is required because executable RUNPATH is not transitive.
+Actual configuration and a separate native `ggml-base` build passed in
+`speech-rpath-check-016`. `readelf` verified that the resulting library has
+RUNPATH `$ORIGIN`; generated executable link flags use the same path.
+This narrow library check does not establish complete runtime relocation.
+The running original snapshot does not contain this correction. Its output
+must not be released as corrected evidence. Next: wait for its terminal result,
+inspect the complete ELF closure, then validate a corrected normal runtime
+outside the build tree with `LD_LIBRARY_PATH` unset and forced CPU recognition.