Qualify Craft Linux runtime dependencies and its missing WebKitGTK API 4.1 provider

Parent: #227. Related: #265 preserves signed Mach-O delivery as a separate platform concern.

Publisher run 41428888448, Linux x86-64 job 125222315715, actually attempted Craft 0.0.423. Its recipe downloaded zero runtime dependencies and publication correctly failed at ELF normalization with unresolved:

libgtk-3.so.0
libgdk-3.so.0
libgio-2.0.so.0
libgobject-2.0.so.0
libglib-2.0.so.0
libwebkit2gtk-4.1.so.0
libjavascriptcoregtk-4.1.so.0

packages/ts-pantry/src/recipes/craft-native.org.ts has no runtime dependency declaration. The normal Linux artifact is still absent. Registry inspection found a real Linux gtk.org/gtk3 3.24.38 provider and published gnome.org/glib artifacts. There is no WebKitGTK recipe/catalog entry or published webkitgtk.org provider. A dependency declaration alone cannot complete this repair.

WebKitGTK API 4.1 uses GTK3 and libsoup3: upstream migration guide, upstream libsoup2 deprecation.

Acceptance:

• Add and qualify a real owning WebKitGTK API 4.1 provider recipe/catalog entry, including required runtime resources and the complete declared dependency closure. Do not substitute WPE/GTK4 APIs or copy host libraries.
• Declare Craft's Linux runtime dependencies with GTK3, GLib and the qualified GTK3/libsoup3 WebKitGTK provider, without adding those dependencies on Darwin.
• Exercise the recipe through the maintained platform-aware dependency resolver and actual ELF closure validation, including native runtime/resource behavior. Keep unresolved-library checks strict.
• Before publishing Craft, establish that the required provider artifacts actually exist and qualify the complete Linux closure. Use the maintained publisher and an immutable new recipe revision.
• Verify the normal Linux installation and retain the real publisher result. Keep this ticket open until actual delivery is qualified.

Do not dispatch another publisher attempt before the missing provider exists. The recorded original failure is expected validation, not a reason to skip ELF normalization or alter Craft's native evaluator.

Read-only provider investigation, without a build or installation claim:

• The official WebKitGTK 2.54.2 source matches its published sums: SHA256 a76345b391bef6211fb5ab6cfab2e86b285d18cda17cbb9ade595f1252b86065. OptionsGTK.cmake selects API 4.1 with USE_GTK4=OFF and requires GTK >=3.22, GLib >=2.70 and libsoup >=3.0. The upstream migration guide confirms that GTK4/API 6.0 is a distinct target.
• Public WebKitGTK metadata currently has no published versions. GTK3, GLib and libsoup metadata contain Linux candidates, but that does not qualify their full ELF/runtime closure. The default source profile also requires unavailable sandbox/helper and media providers, including bubblewrap, xdg-dbus-proxy and GStreamer core/plugins.
• Copying shared libraries is insufficient. In the pinned source, release ProcessExecutablePathGLib.cpp uses compiled absolute PKGLIBEXECDIR; WEBKIT_EXEC_PATH is developer-mode-only. Sandbox configuration likewise embeds absolute executable paths. Pantry resource copying and ELF RPATH normalization do not by themselves prove relocated helper launch.

Next owner acceptance must establish a real API 4.1 source provider, complete public dependency closure, and release-mode relocated web/network/helper, injected-bundle and sandbox/resource behavior with staging roots unavailable. Keep normal ELF checks strict. Do not substitute developer mode, disable the sandbox, copy host/distro libraries or add an external shim. Only after provider publication/qualification should Craft gain Linux-only dependencies under a new immutable packaging revision.

No source changes, native execution, publisher dispatch or provider qualification occurred in this investigation. #266 remains open; #265 signing is separate.

Current source frontier after #272 merged at 4bc358120:

• The earlier absence of a WebKitGTK recipe/catalog entry is historical. #272 now adds webkitgtk.org, the API4.1 selection, helper/injected-bundle runtimeResources, and Craft's Linux-only dependency declarations. Its explicit source profile disables bubblewrap sandboxing, media/GStreamer, gamepad and several optional features. Those exclusions are documented in its recipe, not silent omissions; this is still distinct from qualifying the sandboxed production provider required by this issue.
• The pinned official2.54.2 release source still embeds absolute helper/library/data paths and absolute bwrap/proxy paths. WEBKIT_EXEC_PATH and executable-neighbor lookup are developer-only. Existing RPATH normalization and a public sandbox-path mount API do not themselves relocate process discovery or sandbox-tool execution. The production injected-bundle environment override covers only that bundle and is not a complete relocation solution.
• #273 is now a concrete generic-core blocker: a real public fixUp fixture succeeds, then its copied native helper aborts after relocation because its helper-only declared library was never bundled. Source control returns literal42 plus its own resource, with a separate application7 control. The first native macOS failure is retained. This slice repairs closure/final resource hashes only; it does not add a provider or qualify WebKit.

Remaining #266 acceptance requires actual native Linux source/provider publication and complete runtime/module/resource closure, release-mode relocated web/network/injected-bundle behavior with original build roots unavailable, the intended sandbox/helper isolation and explicit supported feature scope, then normal Craft Linux delivery. Structural recipe tests, a disabled sandbox, developer mode or a link/version-only result do not establish that acceptance. Keep the original Linux publisher failure and strict unresolved-library checks; no publisher retry was dispatched by this investigation.