[codex] Add Debian baseline DEB artifact path

[Jesssullivan]

Summary

• add a Debian 12 baseline/no-WebKit release DEB path named cmux_<version>+deb12_<arch>.deb
• wire release validation to distinguish Ubuntu broad-feature DEBs from Debian baseline DEBs
• teach distro manifest generation/tests about debUbuntu and debDebian
• update Linux install, signing, parity, packaging, and program status docs for the staged Debian artifact path

Validation

• git diff --check
• nix-instantiate --parse nix/tests-distro.nix >/dev/null
• nix-instantiate --parse nix/release-artifacts.nix >/dev/null
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "parsed #{f}" }' .github/workflows/release-linux.yml .github/workflows/test-distro.yml

Follow-up

TIN-745 should remain open until a fresh Linux release-candidate run builds, signs, validates, and uploads the new Debian +deb12 artifacts.

[greptile-apps]

Greptile Summary

This PR adds a dedicated Debian 12 baseline/no-WebKit +deb12 DEB artifact path to the Linux release workflow, promotes Debian 12 testing from a continue-on-error diagnostic to a hard release gate, and threads the new debDebian / debUbuntu distinction through the Nix manifest, distro-test Nix expressions, and related documentation. The debDebian fallback in tests-distro.nix correctly degrades to the Ubuntu DEB when running against older manifests that predate the first +deb12 artifact.

Confidence Score: 4/5

Safe to merge; only P2 style findings, all functional logic looks correct.

No P0 or P1 findings. Two P2 issues: hardcoded local filesystem paths in a touched documentation row, and a redundant deb+debUbuntu duplication in the release manifest generation. The Nix fallback logic, heredoc formatting, and artifact-count validation are all correct.

docs/linux-parity-matrix.md (hardcoded local paths) and the validate-distro-install step in .github/workflows/release-linux.yml (redundant manifest keys).

Important Files Changed

Filename	Overview
.github/workflows/release-linux.yml	Adds build-deb-debian job (Debian 12 baseline DEB), wires it into both validate-distro-install and release needs, refines artifact filtering to distinguish Ubuntu vs Debian DEBs, and promotes Debian 12 from continue-on-error diagnostic to a hard release gate; redundant deb+debUbuntu duplication noted (P2).
.github/workflows/test-distro.yml	Adds optional debDebian block to the override manifest when a +deb12 asset is present; correctly uses -gt 1 (zero is valid for old tags) vs release-linux's -ne 1; heredoc EOF delimiter is at the correct column after YAML indentation stripping.
nix/tests-distro.nix	Splits the single cmuxDebDir into cmuxUbuntuDebDir (with debUbuntu or deb fallback) and cmuxDebianDebDir (uses debDebian when present, otherwise falls back to Ubuntu DEB for backward compat with old manifests); correctly routes each distro VM test to its own artifact.
nix/release-artifacts.nix	Adds a comment noting debDebian is intentionally absent until the first Debian 12 baseline artifact is published; no functional change to the checked-in manifest.
docs/linux-parity-matrix.md	Updates Debian 12 status from 'diagnostic' to 'staged +deb12 path pending first proof'; the touched row still carries hardcoded /Users/jess/git/cmux/ absolute paths in Markdown links (P2).

Comments Outside Diff (1)

1. .github/workflows/release-linux.yml, line 740-748 (link)

   Redundant deb + debUbuntu entries in the distro manifest

   Both attributes are written with identical name/path values, making one permanently dead weight. tests-distro.nix already resolves with debUbuntu or deb, so only debUbuntu needs to be emitted here. Keeping the legacy deb key also risks confusing future readers of the generated manifest. Consider emitting only debUbuntu, or at minimum adding a comment explaining the duplication is intentional backward-compat scaffolding.

_{Reviews (1): Last reviewed commit: "Add Debian baseline DEB artifact path" | Re-trigger Greptile}

[greptile-apps]

Hardcoded local filesystem paths in Markdown links

The links in the Source column use the absolute local path /Users/jess/git/cmux/…, which will resolve to a 404 everywhere except the author's machine (GitHub UI, CI logs, other contributors). The same pattern appears on several rows above this one. The changed line on row 33 is a good opportunity to switch to repo-relative links.

Suggested change

| Distro package install tests | `partial` | [nix/tests-distro.nix](/Users/jess/git/cmux/nix/tests-distro.nix:1), [.github/workflows/test-distro.yml](/Users/jess/git/cmux/.github/workflows/test-distro.yml:1) | Ubuntu 24.04, Fedora 42, and dedicated Rocky 10 exact-artifact release gates pass in run `25090142397`; Debian 12 now has a staged no-WebKit `+deb12` artifact path pending first release proof | keep Ubuntu/Fedora/Rocky exact-artifact gates green, prove the Debian baseline artifact, and add direct graphical QA evidence |

| Distro package install tests | `partial` | [nix/tests-distro.nix](nix/tests-distro.nix), [.github/workflows/test-distro.yml](.github/workflows/test-distro.yml) | Ubuntu 24.04, Fedora 42, and dedicated Rocky 10 exact-artifact release gates pass in run `25090142397`; Debian 12 now has a staged no-WebKit `+deb12` artifact path pending first release proof | keep Ubuntu/Fedora/Rocky exact-artifact gates green, prove the Debian baseline artifact, and add direct graphical QA evidence |