fish-cpp: add CUDA stubs to build linker path; fix verify step's masked failure

Two issues from the first deploy attempt:

1) Build failure (real): linker errors on s2.cpp's CUDA build —
   undefined references to cuMemSetAccess, cuDeviceGet, etc. These
   are CUDA Driver API symbols (in libcuda.so), not Runtime API
   (libcudart.so). The driver lib is provided by NVIDIA's container
   runtime at RUN time, not BUILD time.

   Fix: nvidia/cuda:devel images ship a stubs library at
   /usr/local/cuda/lib64/stubs/libcuda.so that provides the symbols
   for linking but is non-runnable. Adding that path via
   LIBRARY_PATH + CMAKE_LIBRARY_PATH lets the linker resolve while
   leaving runtime unchanged (real libcuda.so comes from the
   driver mount).

2) Verify false positive: the /v1/tts verify step's last command was
   `rm -f "$out"` — which always exits 0. This made the shell's
   final exit code 0 regardless of whether curl/file/grep succeeded,
   so verify reported OK even when nothing was running on host_port.

   Fix: `set -e` at top + trap-based cleanup. Failures now propagate;
   the rm still runs on either path via EXIT trap.

playbooks/deploy-fish-cpp.yaml

@@ -115,14 +115,20 @@ verify:
     changed_when: "false"
 
   - name: /v1/tts returns a real WAV (POST with text body)
+    # `set -e` so curl/file/grep failures actually propagate. The
+    # previous version put `rm -f` as the last command, which always
+    # exits 0 — masking real failures (verify reported OK even when
+    # nothing was running on host_port). Trap-based cleanup runs the
+    # rm even on failure.
     shell: |
+      set -e
       out=$(mktemp --suffix=.wav)
+      trap 'rm -f "$out"' EXIT
       curl -sf -X POST http://localhost:{{ host_port }}/v1/tts \
         -H 'Content-Type: application/json' \
         -d '{"text":"Verify."}' \
         -o "$out" --max-time 60
       file -b "$out" | grep -q '^RIFF.*WAVE'
-      rm -f "$out"
     changed_when: "false"
 
   - name: Container is running

stacks/fish-cpp/Dockerfile

@@ -26,7 +26,15 @@ RUN git clone --recurse-submodules https://github.com/rodrigomatta/s2.cpp.git \
     && git submodule update --init --recursive
 
 WORKDIR /src/s2.cpp
+# CUDA Driver API symbols (cuMemSetAccess, cuDeviceGet, etc.) live in
+# libcuda.so which the NVIDIA driver provides at RUNTIME via --gpus
+# mount. At build time there's no GPU, so we use the stubs library
+# at /usr/local/cuda/lib64/stubs/ which provides the symbols for
+# linking but is NOT runnable. The runtime image uses the real
+# driver-provided libcuda.so via NVIDIA's container runtime.
+ENV LIBRARY_PATH=/usr/local/cuda/lib64/stubs:${LIBRARY_PATH}
 RUN cmake -G Ninja -B build -DCMAKE_BUILD_TYPE=Release -DS2_CUDA=ON \
+      -DCMAKE_LIBRARY_PATH=/usr/local/cuda/lib64/stubs \
     && cmake --build build --parallel $(nproc) --target s2
 
 # ── Stage 2: runtime — slim image with the binary + python shim ────────