test: avoid build env cap'n proto links

.github/workflows/tests.yaml

@@ -34,6 +34,8 @@ jobs:
       contents: read
     steps:
     - uses: actions/checkout@v7
+    - name: Check shipped device runtime dependencies
+      run: python3 -m unittest tools.laptop_device_build.tests.test_runtime_dependencies -v
     - name: Validate tracked dependencies
       run: python3 tools/vendor/check.py --revision HEAD
     - run: ./tools/op.sh setup

tools/laptop_device_build/tests/test_runtime_dependencies.py

@@ -0,0 +1,24 @@
+"""Catch device binaries linked to build-environment Cap'n Proto/KJ libraries."""
+
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+@unittest.skipUnless(sys.platform.startswith('linux'), 'Requires Linux readelf')
+class DeviceRuntimeDependenciesTest(unittest.TestCase):
+  def test_capnp_and_kj_are_not_external_dependencies(self):
+    for binary in ('openpilot/selfdrive/pandad/pandad',
+                   'openpilot/system/camerad/camerad',
+                   'openpilot/system/loggerd/bootlog',
+                   'openpilot/system/loggerd/loggerd',
+                   'openpilot/system/loggerd/encoderd',
+                   'openpilot/tools/replay/replay'):
+      with self.subTest(binary=binary):
+        dynamic = subprocess.check_output(['readelf', '--dynamic', '--wide', str(ROOT / binary)], text=True)
+        self.assertNotRegex(dynamic, r'\(NEEDED\).*\[.*lib(?:capnp|kj)',
+                            f"{binary}: link Cap'n Proto/KJ statically for AGNOS")