…libs

`just tauri-mainnet` couldn't get past the swap build script (libz.so.1
not found) and, once that was bypassed, the tauri webview rendered as a
blank whitescreen with `EGL_BAD_PARAMETER. Aborting...` from WebKit.

Two underlying issues:

  - cc-wrapper's add-flags.sh prepends `-rpath $out/lib` to NIX_LDFLAGS,
    but in nix-shell `$out` is a phantom path that never exists. Every
    binary cargo links here ends up with a dead RUNPATH, so dynamic deps
    (libgit2-sys → libz, webkitgtk → libgdk/libgtk/libstdc++) can't be
    resolved at runtime. Rewrite the rpath in shellHook to point at the
    link-time inputs.

  - WebKitGTK uses libglvnd for EGL/GLX dispatch, but nixpkgs' libglvnd
    has no vendor ICD installed. On NixOS the system populates
    `/run/opengl-driver/lib`; on non-NixOS hosts there's nothing to
    dispatch to. Point libglvnd at nixpkgs' mesa (which ships
    libEGL_mesa.so.0 + swrast_dri.so + the matching egl_vendor.d JSON)
    and force LIBGL_ALWAYS_SOFTWARE so we don't try to talk to the host
    NVIDIA/Mesa drivers (whose ABIs clash with the nix-built lib stack).

This unblocks `cargo tauri dev` end-to-end with the CPU-side renderer.
GPU-accelerated rendering on non-NixOS hosts (nixGL or equivalent) will
follow in a separate change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The previous attempt symlinked the host's NVIDIA libs from /usr/lib64
into a focused dir on LD_LIBRARY_PATH. That got nix's libglvnd to load
the libs, but glXChooseFBConfig still returned NULL ("No available
configurations for the given pixel format"), GTK disabled hardware
acceleration, and WebKit fell back to CPU rasterisation — capping the
GUI at single-digit fps even though the NVIDIA libs were resident.

nixGL builds nix-managed copies of the host's NVIDIA user-space driver
(matching the running kernel module's version) and a wrapper that
points libglvnd at them. Sourcing the wrapper's env-var setup into the
nix-shell at entry gives the WebProcess a working EGL vendor without
needing to wrap every cargo invocation. Combined with GDK_BACKEND=x11
(NVIDIA + native Wayland + nix's webkitgtk hits a Wayland EPROTO during
DMA-BUF setup; XWayland sidesteps that path), WebKit now renders on the
GPU end-to-end:

  - nvidia-smi shows WebKitWebProcess holding ~200 MiB of GPU memory
  - WebProcess CPU drops from ~98% to ~40% under the same workload
  - GPU utilisation jumps from idle to 40-50%

`config.allowUnfree = true` is required on the nixpkgs import for the
NVIDIA runfile fetch. The driver version defaults to 580.142 (matches
the user's current kernel module) and is overridable via
`--argstr nvidiaVersion <ver>`. The shellHook compares the pin against
`/proc/driver/nvidia/version` at entry and warns on mismatch so a
kernel-driver upgrade produces a clear diagnostic rather than silent
GPU breakage.

Hosts without the NVIDIA driver continue to use the nixpkgs mesa
software rasteriser fallback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>