Packages carry their ONNX Runtime; a DEB per Ubuntu LTS

ONNX Runtime stamps its symbols with each release's version, so the
1.0.0 RPM demanded Fedora 42's exact runtime (issue #5) and the Arch
package would break on the next update. The RPM and the Arch package
now bundle Microsoft's 1.21.0 build, as the DEB does, and the images
test against it. The RPM builds on Fedora 43. A DEB built on Ubuntu
26.04 joins 24.04's, and ubuntu.sh picks by codename.

Co-Authored-By: Claude <noreply@anthropic.com>

TASKS.md

@@ -284,7 +284,10 @@ The panel of 4.6 shows and edits what the session holds so far. Each item adds i
 - 11.4c work: the flake's source leaves out the top-level `build/` (`cleanSourceWith`); the NixOS run built the package with it. The crash reproduced every time under ctest and run directly in a kept container with the check's own build; gdb put it in fontconfig's `FcHashTableFind`, under `QMessageBox::setText` in `showError`, under the PNG export's failed snapshot: the alert opened while the 512 KB limit held, and it was the process's first font lookup, whose failed allocation fontconfig dereferences. The app had already handled the failure (it logged the export error). `main` now resolves the alert's fonts before the tests, as the app's window does before any export: five direct runs and ctest pass in the container; with the PNG or the JPEG snapshot's alert removed (`mutate.py`), the test still fails.
 - 11.4c round 1: FAIL, two findings. `thePanelOpensWithoutCopyingTheSnapshot` passed only on the heap its siblings left: alone on the dev image it failed 40 of 40 (it crashed 45 of 45 before the fix), since its limit also held the panel's first open. `initTestCase` now opens a panel and an alert once, the refusal flow, before any limit (the fonts line in `main` went); every test alone and the whole binary pass 40 of 40 on Ubuntu, Arch and NixOS. AGENTS.md put the first font lookup on NixOS alone; it is the first on every system. `mutate.py` then found the JPEG render's capture could copy the snapshot unseen (a gap since 10.3): `theJPEGRenderTakesTheSnapshotWithoutACopy` holds it to a move under a 2 MB limit, the pool thread held so the render waits; the four mutants (both snapshot alerts removed, both captures copied) each fail.
 - 11.4c round 2: PASS, no findings.
-- [ ] 11.4d Issue #5: the RPM demands Fedora 42's exact ONNX Runtime (`libonnxruntime.so.1(VERS_1.20.1)`), and ONNX Runtime stamps a new symbol version on every release, so any other Fedora or update refuses it; the Arch package breaks at run time the same way. Packages carry the runtime they were built with, as the DEB does, and the RPM builds on the oldest Fedora still supported.
+- [x] 11.4d Issue #5: the RPM demands Fedora 42's exact ONNX Runtime (`libonnxruntime.so.1(VERS_1.20.1)`), and ONNX Runtime stamps a new symbol version on every release, so any other Fedora or update refuses it; the Arch package breaks at run time the same way. The user's decisions (2026-09-26): packages carry Microsoft's runtime they were built with, as the DEB does (the RPM and the Arch package bundle it; the Fedora and Arch images test against it too); the RPM builds on the oldest Fedora still supported (43); a second DEB built on Ubuntu 26.04 LTS (resolute) joins the release beside 24.04's (noble), `Dockerfile.dev` taking the base as an argument, and `ubuntu.sh` picks by `UBUNTU_CODENAME`.
+- 11.4d work: the Fedora image is 43 and, like the Arch image, carries Microsoft's ONNX Runtime 1.21.0 (the dev image's block, pinned) in place of the system's; `Dockerfile.dev` takes `BASE`, and `distro-check.sh resolute` runs it on Ubuntu 26.04. The RPM and the Arch package bundle the runtime (`OMAPHOTO_BUNDLE_ORT`): the RPM keeps it out of what it provides and requires, the PKGBUILD fetches the tarball by checksum, lays it out for its CMake config in `prepare()` and drops `onnxruntime`. The release builds `omaphoto-noble_amd64.deb` and `omaphoto-resolute_amd64.deb` (a matrix), and `ubuntu.sh` takes the one its `UBUNTU_CODENAME` names. Evidence: 205 of 205 on Ubuntu 24.04, Arch, Fedora 43 and Ubuntu 26.04; the workflow's package commands build all four; each installs and starts in fresh containers (24.04, 26.04, Fedora 43, 44 and 44 beside `onnxruntime`, Arch and Arch beside `onnxruntime-cpu`), `ldd` finding the bundled runtime; 24.04's DEB is refused on 26.04; the RPM names no `onnxruntime` among its requires or provides; `ubuntu.sh` against a stand-in `curl` installs the right DEB on 24.04 and 26.04 and refuses Debian 13.
+- 11.4d round 1: FAIL, three findings, all words: `arch.sh` still said pacman asks which runtime provides `onnxruntime` (the line went), the README's distro checks left out `resolute`, the workflow's heading said three packages (four).
+- 11.4d round 2: PASS, no findings. Committed; pushed with 1.0.1's tag, since `ubuntu.sh` asks for its asset names.
 - [ ] 11.4e Issues #1 and #2: `dev.sh run` reaches the host's files (the home folder) and the GPU's render nodes, and builds before it runs.
 - [ ] 11.4f Release 1.0.1: the fixes above, the Node 24 actions, the install scripts rerun against the new release; the issues answered and closed.
 - [ ] 12.0 Port Compositor 1.3: survey the upstream changes from 1.1 to 1.3.x and split them into ordered items here before any code.