ci(linux): check the runner's libraries reach the package metadata

The plane added three runtime libraries that bundle-libs.sh deliberately does not
bundle, so they have to be declared per distro by hand - and two hand-maintained
lists drifting apart is the failure this guard exists to prevent.

check_linux_package_deps.py parses the runner's CMake for every pkg-config module
it links, follows target_link_libraries to prove each one actually reaches the
binary, and requires a package name for it in every distro's depends list. It
fails closed on the shapes a naive parser gets wrong: a pkg_check_modules call
naming several modules, options preceding the module name, and version
constraints like mpv>=0.40 that would otherwise be read as a package nobody
ships.

The smoke job builds the three packages and reads the dependencies back out of
the artifacts, deriving what to expect from build-packages.py rather than
restating it - so a library is declared once and verified everywhere. That job is
off by default, which is exactly why it must not carry its own copy of the list.

The Linux native job names libwayland-dev and libegl-dev instead of riding
GTK's and epoxy's transitive dev dependencies, matching the CMake comment's own
rationale. In CI the host-dependency guard runs once: the named step covers the
staged bundle, and build-packages.py's internal run - which exists for by-hand
packaging - is skipped. The smoke job also drops patchelf, which nothing
invokes.

scripts/ci_guard_checks.sh

@@ -5,9 +5,11 @@
 # and script guards" step in .github/workflows/ci.yml and section 4 of
 # scripts/ci_checks.sh. The checkers are named explicitly because a few of them
 # belong to other jobs (check_bun_audit.py needs Bun, check_codegen.py runs via
-# codegen.sh), but their regression tests are discovered by glob so a newly
-# added scripts/test_*.py is picked up automatically instead of having to be
-# remembered in two places.
+# codegen.sh, and linux/packaging/check-bundle-host-deps.py and
+# check-package-deps.py need a built bundle and built packages, so both run in
+# the linux-packages job and again in the release build), but their regression
+# tests are discovered by glob so a newly added scripts/test_*.py is picked up
+# automatically instead of having to be remembered in two places.
 set -euo pipefail
 shopt -s nullglob
 
@@ -24,6 +26,7 @@ for checker in \
   scripts/check_workflow_action_pins.py \
   scripts/check_container_image_pins.py \
   scripts/check_update_packages_workflow.py \
+  scripts/check_linux_package_deps.py \
   scripts/check_windows_installer.py \
   scripts/check_windows_msix.py; do
   python3 "$checker"