core: restrict liboakcore exports to the C ABI via version script

Even statically linked runtime libraries must not leak symbols: the
linker version script now whitelists oakcore_* only. nm reports 188
oakcore_* exports and zero anything else.

core/CMakeLists.txt

@@ -74,6 +74,13 @@ set_target_properties(olivecore PROPERTIES
 # OAKCORE_BUILD marks the library side of the export macros (dllexport)
 target_compile_definitions(olivecore PRIVATE OAKCORE_BUILD)
 
+# Export only the C ABI (oakcore_*), nothing else — not even symbols from
+# statically linked runtime libraries
+if (UNIX AND NOT APPLE)
+  target_link_options(olivecore PRIVATE
+    "LINKER:--version-script,${CMAKE_CURRENT_SOURCE_DIR}/oakcore.map")
+endif ()
+
 # The library builds against its internal implementation headers
 # (src/oliveimpl); consumers only ever see the public C API and wrapper
 # headers (include/olive/core). oliveimpl must come first so that internal

core/oakcore.map

@@ -0,0 +1,6 @@
+{
+  global:
+    oakcore_*;
+  local:
+    *;
+};