Add glibc ceiling check

Fails the build rather than letting a binary that cannot load reach the car,
and names the symbols responsible. Exit 2 is reserved for "could not check",
so a degraded run never reports success.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013kj58Jugkic783b8ZrtTVZ

scripts/check-glibc.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Fail if a binary references a glibc symbol version newer than the car unit has.
+#
+# Detects drift between the development Orin and the car Orin. It does not fix
+# it: the fix is building on a unit whose release matches the target's.
+#
+#   usage: scripts/check-glibc.sh <binary> [ceiling]
+set -euo pipefail
+
+CEILING="${GLIBC_CEILING:-2.35}"
+BIN="${1:?usage: check-glibc.sh <binary> [ceiling]}"
+[ $# -ge 2 ] && CEILING="$2"
+
+# A check that cannot check must not report success.
+command -v objdump >/dev/null 2>&1 || { echo "BROKEN: objdump unavailable, nothing was checked"; exit 2; }
+[ -f "$BIN" ] || { echo "BROKEN: no such binary: $BIN"; exit 2; }
+
+mapfile -t versions < <(objdump -T "$BIN" 2>/dev/null | grep -oE 'GLIBC_[0-9]+\.[0-9]+' | sort -Vu)
+if [ "${#versions[@]}" -eq 0 ]; then
+  echo "BROKEN: no glibc symbol versions found in $BIN — statically linked, or objdump read nothing"
+  exit 2
+fi
+
+max="${versions[-1]#GLIBC_}"
+echo "$(basename "$BIN"): ${#versions[@]} glibc versions referenced, highest GLIBC_$max, ceiling GLIBC_$CEILING"
+
+if [ "$(printf '%s\n%s\n' "$max" "$CEILING" | sort -V | tail -1)" != "$CEILING" ]; then
+  echo "FAIL: GLIBC_$max exceeds the ceiling. Symbols responsible:"
+  objdump -T "$BIN" 2>/dev/null | grep -F "GLIBC_$max" | awk '{print "  " $(NF-1), $NF}' | sort -u
+  echo
+  echo "Build on a unit matching the car Orin's release, or raise the ceiling if"
+  echo "the car unit was upgraded too."
+  exit 1
+fi
+echo "OK"