## What changed
Add the manual `//third_party/voice:native_runtime` target for macOS and GNU Linux. It consumes the native prefix archive, validates the completed build receipt against the target and source manifest, inspects libraries, and prepares verified copies using the existing platform policies.
Record the build commit through Bazel workspace status and include it in runtime receipts. Reject invalid or ambiguous commit metadata and escaping library aliases. Keep macOS preparation local and allow the system `libc++.1.dylib` dependency.
## Testing
Add tests for receipt validation, inspection ordering and failures, invalid commit metadata, and escaping archive links. Add a macOS integration test for preparing real libraries from a sandbox-linked archive with native aliases and either an absent or empty output directory.
GitOrigin-RevId: 23717ab33d1d3da5fb0042c1cc8e8efcd333c386
## Why
The Rust GStreamer bindings link GLib's GIO library even when none of the selected plugins imports it. Following only plugin dependencies can omit a library the bindings need.
## What changed
- Export `gio-2.0` pkg-config metadata in the voice SDK.
- Require GIO as a runtime dependency root on Linux, macOS, and Windows, including its transitive dependencies under the existing import checks.
- Reject runtime packages that omit the required GIO library.
## Testing
Extend fixtures to cover GIO inclusion and missing-library rejection across platforms, loading GIO and its transitive dependency after moving a Linux runtime, and resolving `gio-2.0` through pkg-config after moving an SDK.
GitOrigin-RevId: d12e45d387d56c54d94d788cf07d82bb22c2b4a3
## What changed
- Add a shared runtime preparer that validates native build receipts, source and
file digests, dependency closure, and output containment before copying the
required voice plugins and libraries.
- Add macOS-specific Mach-O inspection and relocation that removes build-time
runpaths, rewrites non-system dependencies relative to each loader, applies
development ad-hoc signatures, and records the resulting payload in
`runtime.json`.
- Close the state runtime explicitly in the clear-memories CLI test.
## Testing
- Add macOS tests covering relocation after the source prefix is removed and
fail-closed handling of invalid receipts, changed inputs, unsafe paths,
dependency conflicts, malformed Mach-O metadata, and failed transforms.
GitOrigin-RevId: 3be7a6fabf0135a57036cbb0a9a3e597096930fd
