Ship OpenAL Soft in the release archive; document the consumers' stale-file cleanup

[viktor-ferenczi]

Two changes: OpenAL Soft moves into the shared pipeline, and the docs catch up with the manifest-based cleanup the consumers now do.

OpenAL Soft

OpenAL was the last native runtime dependency outside this pipeline, and it was handled three different ways depending on the bundle: compiled from source inside Pulsar's Flatpak manifest, and left to LinuxCompat's Assets/ or the host for the developer 7z. DXVK, FFmpeg and the wrappers had all been pulled into Pulsar's Bin/ already — OpenAL alone was left behind.

It is now built by Scripts/build_openal.sh and shipped as libopenal.so.1 (plus the unversioned alias). Both Pulsar bundles get the same pinned binary, and every Flatpak build drops a from-source compile.

Pinned by checksum, not just version. The tarball URL is mutable, unlike the git tags used elsewhere, so the SHA-256 is the real pin — and it is the same checksum Pulsar's Flatpak manifest already carried, which makes this a move rather than a new dependency.

Backends are pinned, not autodetected. This is the part worth reviewing. OpenAL compiles a backend in only when its development headers are present at build time, then dlopens the actual library at runtime. Left to autodetection, a runner without libpulse-dev would silently produce a libopenal that loads fine and plays no sound. The build passes ALSOFT_REQUIRE_PIPEWIRE, ALSOFT_REQUIRE_PULSEAUDIO and ALSOFT_REQUIRE_ALSA so a missing header is a configure-time failure, and the workflow installs those three dev packages. OSS is on (needs no library); JACK, PortAudio, SndIO and the SDL backends are off.

CMAKE_DISABLE_FIND_PACKAGE_SDL3 stops upstream's unconditional find_package(SDL3) from tripping over whatever SDL3 the build host happens to have — a broken system install otherwise fails the configure even though the SDL backend is disabled. That is not hypothetical; it is how the first local build failed.

Verified: the SONAME is asserted to be libopenal.so.1 (Silk.NET dlopens by SONAME, so a bump would leave the bundled copy silently unused), DT_RUNPATH=$ORIGIN is patched on and re-checked, and the ldd allow-list confirms the only NEEDED entries are glibc, libstdc++ and libgcc_s — all four audio backends are dlopened, so the bundle does not hard-require any particular audio stack. A full ./build.sh --clean passes and the archive is 24 MB.

Licensing: OpenAL Soft is LGPL-2.0-or-later with BSD-3-Clause and PFFFT portions. All three texts ship in LICENSES/, alongside a provenance and relinking notice pointing back at build_openal.sh — an LGPL obligation, same as FFmpeg's.

Documentation fix

docs/consuming.md described the fetch as "check stamp, then extract", which predates the manifest-based cleanup both consumers now perform. Without that step a release which renames a file leaves the old copy in the consumer's staging tree, and Pulsar's Legacy.csproj copies that whole tree next to the apphost. It also softens a now-too-blunt line in maintenance.md: renaming a file no longer strands the old copy, though it still breaks any consumer whose expected-file list names it.

Consumer-side changes (not in this PR)

Pulsar and Magnetar are updated on their own branches and will be pushed separately:

• Pulsar drops the openal-soft Flatpak module and symlinks the bundled copy into /app/lib, so loader resolution works exactly as before rather than depending on preload ordering. Preloader aliases cover the name variants Silk.NET probes.
• Magnetar now stages only the licence texts covering what it actually ships. It was copying FFmpeg, DXVK and (now) OpenAL attribution into a headless bundle containing none of those libraries, with the archive's own LICENSES/README.txt listing files that were not there. It also picks up EOS-NOTICE.txt, which it had been shipping libEOSSDK-Linux-Shipping.so without.