Build whisper.cpp without native CPU flags (GGML_NATIVE=OFF) for release builds #534

Target branch: release/0.7.0

Goal

Release builds of the speech crate compile whisper.cpp for a generic CPU of the target architecture instead of the build machine's CPU, so the universal macOS build succeeds and the shipped binaries run on any supported CPU.

Context

• crates/speech/Cargo.toml:19 depends on whisper-rs = "0.16.0", which builds whisper.cpp through whisper-rs-sys 0.15.0.
• whisper-rs-sys 0.15.0 build.rs (lines ~279-286) forwards every environment variable starting with GGML_, WHISPER_ or CMAKE_ as a CMake define.
• whisper.cpp defaults to GGML_NATIVE=ON, which compiles with -mcpu=native / -march=native. Consequences:
  • The universal macOS release build (cross-target aarch64-apple-darwin + x86_64-apple-darwin) fails: failed to run custom build command for whisper-rs-sys v0.15.0 with clang++: error: unsupported argument 'native' to option '-mcpu=', then failed to build aarch64-apple-darwin binary.
  • Linux and Windows release binaries that do build are tied to the CI machine's CPU features; users with older CPUs risk an illegal-instruction crash.
• The repo has a .cargo/ directory (audit.toml, mutants.toml) but no .cargo/config.toml on release/0.7.0 or develop.

Requirements

• Add .cargo/config.toml at the workspace root with:

  [env]
  # whisper.cpp defaults to GGML_NATIVE=ON (-mcpu/-march=native): breaks
  # cross-target builds (universal macOS) and ties release binaries to the
  # build machine's CPU. whisper-rs-sys forwards GGML_* env vars to CMake.
  GGML_NATIVE = "OFF"

• Cargo [env] applies to build scripts, so this covers local builds and all CI/release builds from this workspace. No other changes.

Acceptance Criteria

• .cargo/config.toml exists at the workspace root with [env] GGML_NATIVE = "OFF" and a short comment explaining why.
• After a release-profile build of the speech crate (e.g. cargo build --release -p <speech crate> --target aarch64-apple-darwin on macOS, or the host target elsewhere), the whisper-rs-sys build output no longer uses native CPU flags: target/**/build/whisper-rs-sys-*/out/**/CMakeCache.txt contains GGML_NATIVE:BOOL=OFF and the build output contains no -mcpu=native / -march=native. Record the checked line in the PR description.
• CI is green.
• No changelog fragment (internal build configuration, per changelog.d/README.md).

Technical Notes

• Not a security-critical area; no data model change.
• If a CI environment already sets GGML_NATIVE, an explicit env var wins over [env] (no force = true needed; leave CI env alone).
• Do not add other GGML_* feature flags (AVX etc.); generic target defaults are intended.

Spec impact: none

Related Work

• none