pkg: cmake/platform.cmake; gate libsecret and Qt6::DBus to Linux

Root build infra, per ADR 0020 as amended in 9624e68: PORT owns the per-OS
backend directories and macOS/Windows packaging, but cmake/platform*.cmake stays
PKG/QA's — the amendment exists because Phase 0 (CORE's and DAEMON's own seams,
on Linux) needs velox_platform_sources() to select platform/linux/*.cpp, and PORT
can't start until Phase 0 lands. Landing it as PORT-owned would have deadlocked
both lanes waiting on each other.

cmake/platform.cmake sets exactly one of VELOX_OS_LINUX/VELOX_OS_MACOS/
VELOX_OS_WINDOWS from CMAKE_SYSTEM_NAME and exposes velox_platform_sources(target
dir), which globs dir/platform/<os>/*.cpp. No seam consumes it yet (Phase 0 hasn't
landed), so on Ubuntu this changes nothing observable — VELOX_OS_LINUX is simply
true and no lane calls the new function.

pkg_check_modules(LIBSECRET ...) was unconditional in the root CMakeLists.txt,
so macOS could not configure at all (docs/08-porting.md's stated blocker); it's
now gated on VELOX_OS_LINUX, same as the Qt6::DBus component this also adds
(gui/docs/pkg-qa-requests-m1.md R4 — backs the org.freedesktop.portal
GlobalShortcuts path, which is Linux/portal-only same as libsecret). Both are
still REQUIRED on Linux; PORT adds the macOS sides (Keychain, and no DBus
equivalent needed) behind their own seams, not by touching this find.

Verified: fresh configure + build of veloxd/velox/velox-gui/velox-nmhost still
green (libsecret-1 and Qt6::DBus both found), the .deb from the previous commit
still builds and installs.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0176u3fTrxegrGNm2yC7r69W

CMakeLists.txt

@@ -29,6 +29,10 @@ option(VELOX_BUILD_FUZZ   "Build libFuzzer targets (clang only)"  OFF)
 option(VELOX_ENABLE_MEDIA "Build the HLS/DASH media grabber (M4)" OFF)
 option(VELOX_WERROR       "Treat warnings as errors"              ON)
 
+# Central OS detection (docs/adr/0020-cross-platform-strategy.md). Included early: the
+# dependency finds below gate Linux-only libraries on VELOX_OS_LINUX.
+include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/platform.cmake)
+
 # Project-wide warning flags. Set via add_compile_options (a directory property), not the
 # CMAKE_CXX_FLAGS cache variable, because the dev/tsan presets overwrite that cache var
 # wholesale for sanitizer flags — a target's warnings must not ride on it.
@@ -55,12 +59,24 @@ endif()
 if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/daemon/CMakeLists.txt)
     find_package(SQLite3 REQUIRED)
     find_package(nlohmann_json 3.11 REQUIRED)
-    find_package(PkgConfig REQUIRED)
-    pkg_check_modules(LIBSECRET REQUIRED IMPORTED_TARGET libsecret-1)
+    # libsecret / Secret Service is Linux-only (docs/adr/0020-cross-platform-strategy.md,
+    # docs/08-porting.md): macOS uses Keychain behind the same credential-store seam, so
+    # this stays REQUIRED on Linux and simply absent elsewhere — PORT's job is to add the
+    # macOS side of that seam, not to touch this find.
+    if(VELOX_OS_LINUX)
+        find_package(PkgConfig REQUIRED)
+        pkg_check_modules(LIBSECRET REQUIRED IMPORTED_TARGET libsecret-1)
+    endif()
 endif()
 
 if(VELOX_BUILD_GUI AND EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/gui/CMakeLists.txt)
-    find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network LinguistTools)
+    # DBus (gui/docs/pkg-qa-requests-m1.md R4) backs the org.freedesktop.portal
+    # GlobalShortcuts path — Linux/portal-only, same reasoning as libsecret above.
+    if(VELOX_OS_LINUX)
+        find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network DBus LinguistTools)
+    else()
+        find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network LinguistTools)
+    endif()
     qt_standard_project_setup()
 endif()