fix(collabora): check linkage with ldd instead of booting coolwsd

"coolwsd --version" does not short-circuit: it runs a full initialisation and
tries to create a jail, which fails in a build layer because the --o: paths the
launcher passes are absent, so it looked for /usr/bin/jails. It did prove the
binaries link against the Debian base, but booting Collabora is the wrong check
for a build step.

ldd asserts the same thing directly: every NEEDED library of coolwsd,
coolforkit-ns and coolmount resolves on this base. The loop uses an if rather
than "grep && exit 1" so that a clean result does not leave the loop with
grep's non-zero status and fail the good case.

Co-Authored-By: Claude <noreply@anthropic.com>

collabora/Dockerfile

@@ -107,13 +107,19 @@ RUN \
     rm -rf /etc/coolwsd/proof_key* && \
     fc-cache /opt/collaboraoffice/share/fonts/truetype > /dev/null 2>&1 || true
 
-# Fail the build rather than ship an image that cannot start: ha_autoapps.sh is
-# invoked with "|| true", and coolwsd comes from an image built against a
-# different libc, so both are worth proving here. coolwsd refuses to run as
-# root, so this runs it exactly the way 99-run.sh does.
+# Fail the build rather than ship an image that cannot start. ha_autoapps.sh is
+# invoked with "|| true", so a missing package would go unnoticed, and the
+# binaries were built inside the upstream Nix image against a different libc.
+# ldd is the right check here: it resolves every NEEDED library against this
+# base without booting Collabora, which would try to build a jail.
 RUN \
     command -v openssl > /dev/null && \
-    su -s /bin/bash cool -c "/usr/bin/coolwsd --version"
+    command -v su > /dev/null && \
+    for binary in /usr/bin/coolwsd /usr/bin/coolforkit-ns /usr/bin/coolmount; do \
+    if ldd "$binary" | grep "not found"; then \
+    echo "unresolved shared libraries in $binary" && exit 1; \
+    fi; \
+    done
 
 ################
 # 4 Entrypoint #