ci(gfx11): bundle liborigami + add ldd-closure backstop and packaging gate

[jimw567]

Summary

Release b20260724 shipped broken: llama-server exits 127 and llama-bench emits no JSON, both with error while loading shared libraries: liborigami.so.1: cannot open shared object file.

Root cause: the "Copy ROCm core libs" step is a hand-maintained cp -v allowlist (its own comment warns "If artifacts from ROCm or Llama.cpp change, you may need to update this list."). The b20260724 build bumped ROCm 7.14 -> 7.15, and 7.15's libhipblaslt.so.1 gained a new DT_NEEDED on liborigami.so.1 (a new hipBLASLt kernel-selection lib). Nobody added a cp line for it, so it was omitted from the tarball. Every binary has RUNPATH=$ORIGIN, so libhipblaslt.so.1 loads from the release dir but then fails to resolve its own liborigami.so.1 dep.

Why CI didn't catch it: the only post-build smoke test runs llama-cli, which links hipBLASLt lazily and loads fine. llama-bench/llama-server load hipBLASLt eagerly and break. (Confirmed via ldd on the actual b20260724 binaries.)

Changes

1. Explicit fix - add cp -v /opt/rocm/lib/liborigami.so* to the allowlist next to libhipblaslt.
2. Transitive-closure backstop - after the manual copies, ldd every bundled binary, and for any => not found dep that exists under /opt/rocm/lib{,/rocm_sysdeps/lib,/llvm/lib}, copy it in; repeat until closed. The next ROCm bump that adds a new NEEDED lib is auto-bundled instead of silently shipping broken.
3. GPU-free packaging gate - new "Verify bundled binaries have no unresolved deps" step after RPATH-setting: ldds every binary and fails the build if anything is unresolved. Runs unconditionally and gates create-release. (Note: the GPU test-gfx job is currently if: false while the runner is offline, so this build-job gate is the real protection.)
4. Widened HW smoke test - add an llama-bench load check to test-gfx so the eager-hipBLASLt path is exercised once the GPU runner returns.

Test plan

• Build job's new verify gate passes on a healthy build and fails if a bundled binary has an unresolved dep (verified locally against the real b20260724 tree: the gate flags liborigami.so.1 and exits 1).
• Backstop copies liborigami.so.1 from /opt/rocm/lib into build/bin on the 7.15 toolchain.
• Resulting tarball: ldd llama-bench and ldd llama-server show no not found deps.
• test-gfx (when runner online) passes both the llama-cli and new llama-bench checks.

[Annieren]

lgtm