Linux: engines and apps build in an Ubuntu 26.04 container, glibc 2.43 at most (L1.4)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/TASKS.md

@@ -204,7 +204,7 @@
 - [x] L1.1 Linux 显示后端：`gpui_platform` 开 `wayland` 与 `x11`（原样无头，“window open”而合成器里没有窗口）；Omarchy（Hyprland）上 ElyTree 在 Wayland 与 X11 上画出窗口（其余五个要引擎，随 L1.6 实测）；`tests/scripts/linux-backends.sh` — R1 锁文件、目标目录、未证明交帧；R2 产物路径、字形未核；R3 语言、OCR 错误被吞；R4 PASS
 - [x] L1.2 Linux 上的文件监视把读取当作改动（inotify 报打开，FSEvents 不报）：Omarchy 主题、通用设置在第一次改动后、ElyTree 打开仓库起，每次重读自己又触发下一次，空闲时每 250 毫秒读一遍；四处监视（主题、设置、ElyTree、ElyMark）经 `ely_ui::watching::only_read` 略去读取，写后关闭照算改动；`theme.name` 读不出不再吞掉；`tests/scripts/linux-idle.sh`（ElyMark 要 CEF，随 L1.6 实测） — R1 写后关闭也被略去、注释超长；R2 PASS
 - [x] L1.3 设置的单测在 Linux 上失败（“a menu bar needs menus”）：Linux 未设菜单时给空表而非 None，测试未像应用那样先设菜单；真窗口里 Ctrl+, 打开设置不崩（已实测） — R1 PASS
-- [ ] L1.4 Linux 构建环境：`ubuntu:26.04` 容器里构建全部引擎与六个应用（glibc 不高于 2.43）
+- [x] L1.4 Linux 构建环境：`ubuntu:26.04` 容器里构建全部引擎与六个应用（glibc 不高于 2.43）；`packaging/linux/container.sh`、`tests/scripts/linux-glibc.sh` — R1 读不出当作静态、缺件照过、注释超长；R2 链接文件、读错；R3 链接目录；R4 PASS
 - [ ] L1.5 Linux 包：deb、rpm、Arch（pkg.tar.zst）、AppImage 出自同一份分装，装到 `/opt/ely-office/<应用>`，带桌面项、图标与文件类型
 - [ ] L1.6 本机出六个应用的四种包；Omarchy 上装 Arch 包与 AppImage 出窗口；deb、rpm 在各自发行版的容器里装上并冒烟
 - [ ] L1.7 v0.1.3：删去旧 AppImage，上传新包；`ci.sh` 的 Linux 产出四种包；agents.md 与官网随之

tasks/reviews/L1.4-r1.md

@@ -0,0 +1,9 @@
+FAIL
+
+- tests/scripts/linux-glibc.sh:26 — A failed `readelf` command is treated as evidence that the ELF is static. With `readelf` forced to return 1, the existing outputs still exit 0 and report all 187 ELF files compliant (`.work/L1.4-r1-readelf-failure.log`). A missing tool or failed inspection therefore bypasses every glibc check. Check tool availability explicitly and propagate inspection errors; skip version analysis only after a successful inspection establishes that the binary is static.
+
+- tests/scripts/linux-glibc.sh:19 — Required outputs only need to exist; non-ELF files are skipped at line 23, and line 32 requires just one ELF across all inputs. A compiled probe with eight text files in place of the applications/workers, empty LibreOffice and CEF directories, and one unrelated ELF under Git exits 0 (`.work/L1.4-r1-non-elf.log`). Validate each required application/worker as an ELF and require the actual engine binaries before scanning their versions.
+
+- tests/scripts/linux-glibc.sh:31 — The `find` process substitution loses enumeration failures, allowing a partial scan to pass. With valid ELF inputs and an unreadable LibreOffice subdirectory containing another ELF, `find` reports permission denied, but the test exits 0 and declares the 11 accessible ELF files compliant (`.work/L1.4-r1-find-failure.log`). Check and propagate the enumeration status before reporting success.
+
+- packaging/linux/container.sh:2 — Scoped comments violate the mandatory one-line, ten-word limit: this line has 12 words, line 12 has 11, packaging/linux/Dockerfile:1 has 12, and tests/scripts/linux-glibc.sh:2 has 11. scripts/build-git.sh:40 and :41 also form consecutive comment lines. The repository comment checker rejects the shell comments (`.work/L1.4-r1-comments.log`). Shorten the long comments and remove or separate the consecutive explanation and directive.

tasks/reviews/L1.4-r2.md

@@ -0,0 +1,7 @@
+FAIL
+
+- packaging/linux/container.sh:2 — The round 1 comment defect remains: this comment has eleven words, and scripts/build-git.sh:40–41 still has consecutive comment lines. Running tests/scripts/comments.py exits 1 and rejects both (`.work/L1.4-r2-comments.log`). Shorten the remaining long comment and remove or separate the consecutive comments.
+
+- tests/scripts/linux-glibc.sh:28 — Required outputs may be symlinks, but `find -type f` excludes them from version inspection. A compiled application probe declaring GLIBC_2.99 fails as a regular file; replacing it with a symlink to the identical ELF makes the test exit 0 and report only ten compliant files (`.work/L1.4-r2-probes.log`). Inspect every required ELF regardless of symlinks and include referenced engine libraries in the scan.
+
+- tests/scripts/linux-glibc.sh:32 — `is_elf` conflates failed reads with non-ELF content, so engine inspection errors still produce success. An additional LibreOffice library declaring GLIBC_2.99 correctly fails while readable; making that file unreadable prints `head: Permission denied` but exits 0 and declares the eleven other ELF files compliant (`.work/L1.4-r2-probes.log`). Propagate header-read failures and skip files only after successfully reading and identifying non-ELF content.

tasks/reviews/L1.4-r3.md

@@ -0,0 +1,3 @@
+FAIL
+
+- tests/scripts/linux-glibc.sh:28 — The scan checks symlinked files but never traverses symlinked directories, so required engines can still escape version inspection. In the probe, a regular LibreOffice `program` directory containing `libmergedlo.so` declaring GLIBC_2.99 correctly fails; replacing that directory with a symlink to the same contents exits 0 and reports ten compliant ELF files. A linked library subdirectory also hides an incompatible library (`.work/L1.4-r3-probes.log`). Follow engine directory links while propagating traversal errors, and ensure every required ELF receives version inspection regardless of its directory layout.

tasks/reviews/L1.4-r4.md

@@ -0,0 +1 @@
+PASS