Fix linux crash issue

[bettercallsaulj]

Summary

This PR fixes the Linux native-package crash by making the Python SDK package and
loader agree on how native libraries are built, named, bundled, and resolved on
Linux.

The crash path was Linux wheel loading: the package could miss the right
versioned native library or ship dependencies that were not portable across the
target runtime. The fix is split across the build and runtime sides:

• Rework build.sh for Linux native builds and add an Ubuntu 20.04 cross-build
  path for the Linux x64 wheel.
• Pin the Linux builder image to ubuntu:20.04@sha256:8feb4d8c..., while
  keeping it overridable through an ARG.
• Stop bundling libssl.so* and libcrypto.so* into published Linux wheels.
• Make patchelf failures hard failures so broken runtime paths are caught
  during packaging.
• Resolve versioned native library names correctly on Linux and macOS instead
  of relying on lexicographic ordering.
• Add CI/package checks for Linux native dependencies to prevent regressions.

Other Fixes In This Stack

• Improve native loader diagnostics and point users at DEBUG=1, which is the
  environment variable the code actually reads.
• Raise and document clearer agent errors when native run() returns null.
• Expand public auth exports and remove the confusing top-level auth error name
  collision.
• Share API example venv setup across all seven wrappers so the Linux/Debian
  dependency setup applies consistently.

Validation

• 151 passed, 116 skipped, 3 failed
• The three failures reproduce identically on origin/main and require
  ./build.sh, so this branch did not introduce them.

[dIvYaNshhh]

Some really useful stuff in here — _load_errors plus get_load_error_message() turns an opaque "failed to load native library" into a per-path list of what was tried and why each failed, which is the diagnostic that's been missing. get_last_error_message() picking up the details field is a straight win too; the C side was populating something we were throwing away. And the "preserve local debug checkout" logic is thoughtful — checking both status --short and recorded-vs-current SHA is the right pair of conditions.

Also glad to see this reverts #12's --remote submodule change back to recorded-SHA-first.

That said, I had a hard time reviewing it, because the title says "Fix linux crash issue" and the description is empty, but the diff is four separate workstreams: the Ubuntu 20.04 Docker cross-build (the actual fix, I think?), a build.sh rewrite with per-target output dirs, error-message plumbing across agent.py/library.py, and a ~40-symbol expansion of the public auth exports. Could those be split, or at minimum could the description explain what the crash was and which part addresses it? The auth re-export change in particular is a public API change that has nothing to do with Linux.

Blocking-ish items, all inline:

• The Debian pip fix only landed in 2 of the 7 example wrappers — five still break on the platform this PR targets. And the VENV_PYTHON fallback can pip-install into the user's system Python.
• We're bundling EOL OpenSSL 1.1.1 into shipped Linux artifacts.
• patchelf failures are silently swallowed, in the script that exists to fix Linux loading.
• The new error message tells users to set GOPHER_DEBUG=1, which isn't a variable this codebase reads.
• run() now raises where it used to return a string — breaking, no CHANGELOG entry.

One carried-over concern: this keeps #12's cwd-first library search order and grows it to three cwd entries, one of which (native/current) is now a symlink that build.sh creates. So we're following a symlink from the current working directory ahead of the installed package. Same argument as on #12 — please gate that behind a dev opt-in.

Smaller things: native/ output is written three times per build (per-target dir, current symlink, and a flat copy into native/lib), and the linux-on-macOS skip-rebuild path trusts the stamp with no symbol check where the macOS path runs nm.

[dIvYaNshhh]

Re-reviewed at dc0426e6. All eight comments addressed — resolving every thread, nothing outstanding from me.

• OpenSSL — libssl.so*|libcrypto.so* added to the bundling skip list, so we're no longer vendoring an EOL TLS stack into published wheels. This was my main concern on this PR.
• patchelf — 2>/dev/null || true is gone; it hard-fails now, which is what you want in the script that exists to fix Linux loading.
• Dockerfile — pinned to ubuntu:20.04@sha256:8feb4d8c…, and via an ARG so it stays overridable. Better than what I suggested.
• GOPHER_DEBUG → DEBUG=1 — the hint now names a variable the code actually reads.
• Versioned library resolution — the lexicographic sorted()[0] problem and the macOS libfoo.0.1.30.dylib naming are both handled.
• Auth error naming — no longer two same-named-but-unrelated exception types at the top level.
• run() null-response — behaviour change documented.
• Linux native dependency verification added, which closes the macOS/Linux asymmetry I flagged.

The one I want to call out specially is 6e97e5a3 / c4feb45b: the venv setup is now shared across all seven wrappers rather than the two this PR originally patched. That was the structural item I raised back on #10 and I'd half expected it to get deferred indefinitely — good to see it actually done, and it means this PR's Debian fix now applies everywhere instead of to 2/7 of the examples.

Suite at the tip of the stack: 151 passed, 116 skipped, 3 failed — all three failures reproduce identically on origin/main (they want ./build.sh), so nothing regressed.

Only leftover is the empty PR description. This one in particular would benefit: the title says "Fix linux crash issue" but the diff spans a Docker cross-build, a build.sh rewrite, error-message plumbing, and a public auth export expansion. A short note on what the crash was and which part fixes it would help whoever picks this up next.