ci(linux): check the runner's libraries reach the package metadata

The plane added three runtime libraries that bundle-libs.sh deliberately does not
bundle, so they have to be declared per distro by hand - and two hand-maintained
lists drifting apart is the failure this guard exists to prevent.

check_linux_package_deps.py parses the runner's CMake for every pkg-config module
it links, follows target_link_libraries to prove each one actually reaches the
binary, and requires a package name for it in every distro's depends list. It
fails closed on the shapes a naive parser gets wrong: a pkg_check_modules call
naming several modules, options preceding the module name, and version
constraints like mpv>=0.40 that would otherwise be read as a package nobody
ships.

The smoke job builds the three packages and reads the dependencies back out of
the artifacts, deriving what to expect from build-packages.py rather than
restating it - so a library is declared once and verified everywhere. That job is
off by default, which is exactly why it must not carry its own copy of the list.

The Linux native job names libwayland-dev and libegl-dev instead of riding
GTK's and epoxy's transitive dev dependencies, matching the CMake comment's own
rationale. In CI the host-dependency guard runs once: the named step covers the
staged bundle, and build-packages.py's internal run - which exists for by-hand
packaging - is skipped. The smoke job also drops patchelf, which nothing
invokes.

scripts/verify_runtime_inputs.py

@@ -88,6 +88,12 @@ def _validate_native(root: Path, errors: list[str]) -> None:
         _require_text(value.get("provenance"), f"{label}.provenance", errors)
         if url and not url.startswith("https://"):
             errors.append(f"{label}.url: production source must use HTTPS")
+        # A fallback source is optional, but it is a production source when it is
+        # used, so it answers to the same rule as the primary.
+        mirror = value.get("mirror")
+        if mirror is not None:
+            if not isinstance(mirror, str) or not mirror.startswith("https://"):
+                errors.append(f"{label}.mirror: production source must use HTTPS")
         if version and url and name in {"ffmpeg", "mpv", "simdutf"} and version not in url:
             errors.append(f"{label}.url: must identify declared version {version}")
         if kind == "archive":