cockpit: scrub compiler and -dev store paths from runtime closure

C binaries embed store paths of gcc and *-dev inputs as strings
(include/comp_dir style). Nix treats those as runtime dependencies,
keeping the full compiler and header packages in the closure.

Remove the accidental references with remove-references-to and guard
with disallowedRequisites. Measured x86_64-linux closure drop:
~867M -> ~543M.

Assisted-by: Grok by xAI (Grok Build)

pkgs/by-name/co/cockpit/package.nix

@@ -35,6 +35,7 @@
   pkg-config,
   polkit,
   python312Packages,
+  removeReferencesTo,
   sscg,
   systemd,
   udev,
@@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     pam
     pkg-config
     python3Packages.setuptools
+    removeReferencesTo
     systemd
     xmlto
   ];
@@ -250,9 +252,34 @@ stdenv.mkDerivation (finalAttrs: {
       popd
     ''}
 
+    remove-references-to \
+      -t ${stdenv.cc.cc} \
+      -t ${lib.getDev stdenv.cc.libc} \
+      -t ${lib.getDev glib} \
+      -t ${lib.getDev json-glib} \
+      -t ${lib.getDev systemd} \
+      -t ${lib.getDev gnutls} \
+      -t ${lib.getDev krb5} \
+      "$out/lib/security/pam_ssh_add.so" \
+      "$out/libexec/cockpit-certificate-ensure" \
+      "$out/libexec/cockpit-session" \
+      "$out/libexec/cockpit-tls" \
+      "$out/libexec/cockpit-ws" \
+      "$out/libexec/cockpit-wsinstance-factory"
+
     runHook postFixup
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+    (lib.getDev stdenv.cc.libc)
+    (lib.getDev glib)
+    (lib.getDev json-glib)
+    (lib.getDev systemd)
+    (lib.getDev gnutls)
+    (lib.getDev krb5)
+  ];
+
   nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   checkInputs = [