mars(kittentts): patch venv .so RPATHs so numpy/onnxruntime load

The venv's python is Nix python313 (also inside the container, via the
/nix/store mount), whose loader never searches /usr/lib, so PyPI manylinux
wheels failed with "libstdc++.so.6: cannot open shared object file".
auto-patchelf the staged venv against gcc-lib + zlib; RPATHs are store
paths, so the delivered copy works in the container too. The lib paths join
the input hash so a toolchain bump rebuilds.

Verified locally with mars's exact uv/python313: construct offline from the
staged hub layout and synthesize with voice "Luna".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/mars/hermes-agent.nix

@@ -89,6 +89,7 @@ let
   kittenttsWheelFile = "${pkgs.linkFarm "kittentts-wheel" {
     "kittentts-0.8.1-py3-none-any.whl" = kittenttsWheel;
   }}/kittentts-0.8.1-py3-none-any.whl";
+  kittenttsRuntimeLibs = "${pkgs.stdenv.cc.cc.lib}/lib ${pkgs.zlib}/lib";
   kittenttsReqs = pkgs.writeText "kittentts-requirements.txt" (
     builtins.readFile ./kittentts/requirements.txt
   );
@@ -539,7 +540,7 @@ in
     ];
     requires = [ "hermes-agent-prepare-dirs.service" ];
     # diffutils: `cmp` in the fast path; missing, it silently re-delivers every boot.
-    path = [ pkgs.uv pkgs.coreutils pkgs.diffutils pkgs.util-linux ];
+    path = [ pkgs.uv pkgs.coreutils pkgs.diffutils pkgs.util-linux pkgs.auto-patchelf pkgs.patchelf ];
     serviceConfig = {
       Type = "oneshot";
       TimeoutStartSec = 600;
@@ -571,9 +572,9 @@ in
       # Input key: requirements + wheel + stub + model files + resolved script.
       # Review #5 — a miss on the old requirements-only stamp let a changed
       # wheel/stub/model URL keep running the stale install forever.
-      inputHash=$(cat ${kittenttsReqs} ${kittenttsWheel} ${kittenttsStub} \
-        ${kittenttsModelOnnx} ${kittenttsModelVoices} ${kittenttsModelConfig} \
-        | sha256sum | cut -d' ' -f1)
+      inputHash=$({ cat ${kittenttsReqs} ${kittenttsWheel} ${kittenttsStub} \
+        ${kittenttsModelOnnx} ${kittenttsModelVoices} ${kittenttsModelConfig}
+        echo ${kittenttsRuntimeLibs}; } | sha256sum | cut -d' ' -f1)
       stampFile=$stageDir/provision.stamp
 
       # Idempotent early exit: stamp matches the full input hash, staging venv
@@ -631,6 +632,10 @@ in
         siteDir=$("$stageVenv/bin/python" -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')
         cp ${kittenttsStub} "$siteDir/kitten_tts_stub.py"
         printf 'import kitten_tts_stub\n' > "$siteDir/zz-kitten-stub.pth"
+
+        # PyPI manylinux .so's (numpy, onnxruntime) need libstdc++, which the
+        # Nix loader never finds, on the host or in the container.
+        auto-patchelf --paths "$stageVenv" --libs ${kittenttsRuntimeLibs}
       fi
 
       # Stage the full delivered hub tree (exact hf_hub_download layout: