#36270 build: ensure release binaries don't contain `depends` references

• Prevent release binaries from leaking build-host depends paths that do not exist on user systems
• Automatically enforce in release checks that release binaries do not retain these path references

Strips build-host `/bitcoin/depends` directory paths out of Linux Guix release binaries using prefix mapping and explicit configure options for Qt and its dependencies. It also extends `symbol-check.py` to enforce that ELF binaries do not contain `/bitcoin/depends/` string remnants.

Problem: Release binaries currently retain debug symbols and runtime fallback paths pointing to `/bitcoin/depends/` on the Guix build host, which do not exist on user systems.

P3 · cleanup

• P3 because it is a hygiene improvement for release binaries and build reproducibility
• Automated release verification prevents future host path leaks

Hygiene improvement for release binaries and build reproducibility. As fanquake notes, 'It doesn't make sense for the release binaries to contain references to depends... as it's unlikely that "depends" exists on a users system at runtime.' Adding automated symbol-check verification prevents future path leaks.

Membership: Modifies depends package makefiles, Guix build scripts, and the Guix symbol-check release verification script.

Factors: security/stability 1, bug 0, performance 0, user value 1, leverage 1

• Ready for review
• Small patch that passes CI

The patch is small, passes CI, and is ready for concept and implementation review despite the draft tag.

Author status: active

• No feedback yet from reviewers
• Recently opened without reviews or comments

No feedback yet

The PR was recently opened and has received no reviews or comments.

Review verdicts (DrahtBot): 0

7 lines under test/bench/ci.

• contrib/guix/symbol-check.py +5/-0
• depends/packages/native_qt.mk +1/-1
• depends/packages/qt.mk +1/-1
• contrib/guix/libexec/build_linux.sh +1/-0
• contrib/guix/libexec/build_linux_gui.sh +1/-0
• depends/packages/libxcb_util_cursor.mk +1/-0
• depends/packages/libxkbcommon.mk +1/-0

PR #36270 prevents `/bitcoin/depends` build directory paths from ending up in Linux release binaries. It adds prefix-map compiler flags, sets default system paths in depends packages (Qt, libxkbcommon, libxcb_util_cursor), and adds an automated assertion in `symbol-check.py`. It solves path leakage in release binaries that can point runtime lookups to non-existent build dirs. The PR is a draft opened recently by fanquake with no reviews yet.