fix: drop core26 paths from ELF RPATHs

[gboutry]

Snapcraft ELF patching keeps staged libraries available to helpers that discard LD_LIBRARY_PATH. It also appends an absolute base-snap path that strict confinement cannot read, causing dynamic linker denials before fallback to the mounted base.

Remove only core26 path components in the final prime step. Preserve both the remaining paths and each object’s RPATH or RUNPATH type.

Core26 libraries are mounted and available in the snap namespace under regular /usr/lib/x86_64-linux-gnu and cannot be access via /snap/core26/... paths.

Assisted-By: Codex (gpt-5-6-sol)

Closes-bug: #2165975

QA steps

Refresh an existing sunbeam deployment hypervisor snap with a build of this PR:

snap install ./openstack-hypervisor_2026.1-8594f23f_amd64.snap --dangerous
sudo snap set openstack-hypervisor telemetry.enable=true # this will start the ceilometer process

The following errors should no longer appear in audit logs / snappy-debug:

2026-08-28T16:46:39.758784+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8426): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.7.0" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2026-08-28T16:46:39.758785+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8427): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.7.0" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2026-08-28T16:46:39.758786+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8428): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.7.0" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2026-08-28T16:46:39.758787+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8429): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.41.1" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2026-08-28T16:46:39.758788+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8430): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.41.1" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2026-08-28T16:46:39.758788+00:00 sunbeam kernel: audit: type=1400 audit(1787935599.757:8431): apparmor="DENIED" operation="open" class="file" profile="snap.openstack-hypervisor.ceilometer-compute-agent" name="/snap/core26/462/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.41.1" pid=985215 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Ceilometer is still failing on a python3.14 compatibility issue, to fix in a subsequent PR.

Links

https://bugs.launchpad.net/snap-openstack-hypervisor/+bug/2165975
OPEN-4737

[hmlanigan]

Updates for the PR description:

• Add a link to the Jira card for this work
• Remove the empty bug related links.

Please follow conventional commits for this change.

I am unable to run the QA steps as they do not include how to integrate the openstack-hypervisor snap to test into the workflow.