Fix Linux AppImage: strip CUDA deps from onnxruntime binaries

linuxdeploy scans all ELF binaries in the AppDir and fails when it
can't find libcublasLt.so.12 (a CUDA library referenced by the
onnxruntime native module). Use patchelf to remove these optional
CUDA dependencies since we only need CPU inference.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/desktop-release.yml

@@ -303,10 +303,18 @@ jobs:
       - name: Validate managed runtime bundle
         run: npm run validate:managed-runtime --workspace=@getpaseo/desktop
 
-      - name: Remove CUDA/TensorRT providers from onnxruntime
+      - name: Strip CUDA dependencies from onnxruntime
         shell: bash
         run: |
           find packages/desktop/src-tauri/resources/managed-runtime -path '*/onnxruntime-node/bin/*' \( -name '*cuda*' -o -name '*tensorrt*' \) -delete || true
+          # Remove CUDA shared library references from onnxruntime .so files so linuxdeploy
+          # doesn't try to bundle them (they're optional runtime deps, not needed for CPU inference)
+          for f in $(find packages/desktop/src-tauri/resources/managed-runtime -path '*/onnxruntime-node/bin/*' \( -name '*.so' -o -name '*.so.*' \)); do
+            for lib in $(patchelf --print-needed "$f" 2>/dev/null | grep -iE 'cublas|cudnn|cudart|cufft|curand|cusolver|cusparse|nccl|nvrtc|tensorrt|nvinfer'); do
+              echo "Removing needed $lib from $f"
+              patchelf --remove-needed "$lib" "$f"
+            done
+          done
 
       - name: Detect existing GitHub release state
         if: env.IS_SMOKE_TAG != 'true'