chore(diag): also prove the pin fixes it, on the same Sonoma runner

The shipped build dies on macOS 14 with a STRONG reference to
_OBJC_CLASS_$_MTLResidencySetDescriptor (Metal, macOS 15+) from
libggml-metal — not on the libc++ symbols predicted. Locally the pinned
rebuild turns that same reference WEAK. This job checks the prediction
that follows: that it therefore runs.

Author: EtienneLescot

.github/workflows/diag-libcpp-floor.yml

@@ -77,3 +77,44 @@ jobs:
           else
             echo "INCONCLUSIVE — neither a loader error nor the usage message. Read the logs above."
           fi
+
+  # The other half: does the deployment-target pin that landed in #527 actually make the
+  # payload runnable on Sonoma, or does it only move the failure? Builds from main with
+  # the pin and runs the result on the same runner that just rejected the shipped one.
+  rebuilt-stt-on-sonoma:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+
+      - name: Confirm the pin is in the tree under test
+        run: |
+          sw_vers -productVersion
+          grep -n 'MACOS_DEPLOYMENT_TARGET=' scripts/build-whisper-stt.sh
+
+      - name: Build whisper-stt-server with the pin
+        run: bash scripts/build-whisper-stt.sh
+
+      - name: What the rebuilt binary declares and imports
+        run: |
+          cd electron/native/bin/darwin-arm64
+          vtool -show-build whisper-stt-server | grep -E 'minos|sdk'
+          echo "--- the Metal class that killed the shipped build ---"
+          nm -m libggml-metal.dylib | grep MTLResidencySet || echo "  (not referenced)"
+          echo "--- the 15.4-gated libc++ symbols ---"
+          echo "count: $(nm -m whisper-stt-server | grep undefined | grep -c 'bad_function_callE')"
+
+      - name: Try to run it
+        run: |
+          cd electron/native/bin/darwin-arm64
+          set +e
+          ./whisper-stt-server --help > out.txt 2> err.txt
+          echo "exit=$?"
+          echo "--- stdout ---"; cat out.txt
+          echo "--- stderr ---"; cat err.txt
+          if grep -qiE 'symbol not found' err.txt; then
+            echo "FIX INSUFFICIENT: still cannot load on $(sw_vers -productVersion)."
+            exit 1
+          fi
+          echo "FIX CONFIRMED: the pinned build loads and runs on $(sw_vers -productVersion)."