Add Linux AppImage shipping foundation

[brxs]

Part of #112.

Depends on #107, #108, #110, and #111. This is a stacked draft targeting codex/107-integration; it deliberately does not close #112 or claim hardware qualification.

What changed

• split shared, macOS, and Linux Tauri configuration while preserving the signed macOS path
• added an Ubuntu 22.04-compatible x86_64 AppImage builder and deterministic package/ELF audit
• added an Ubuntu 22.04 hosted package job with a virtual-X11 launch under XDG paths containing spaces and Unicode
• made Linux a required, fail-closed producer in the existing single-publisher release policy
• added a managed-runtime launch policy that refuses developer uv/Python/Git/shell fallbacks in portable packages; Add a production PyTorch MRT2 backend for Linux and Windows #110/Add a portable Stable Audio 3 TFLite backend #111 can supply explicit verified adapter executables through the existing launch contract
• added structured, non-invasive Linux distribution/session/XDG/audio/MIDI diagnostics
• normalized class-compliant ALSA MIDI port names while retaining raw names for device selection
• documented AppImage installation, PipeWire/ALSA and MIDI/udev diagnostics, first-run boundaries, and the real-hardware qualification matrix

User and release impact

The desktop shell can now be packaged and smoked as an AppImage without introducing a system Python, Git, CUDA toolkit, or shell runtime dependency. A missing production MRT2 or Stable Audio adapter fails with a stable diagnostic code instead of silently using developer tools from PATH.

The AppImage remains pre-release. Hosted CI proves package construction and virtual-X11/XDG behavior only. Public support still requires the dependency work and the checked hardware evidence in docs/linux-qualification-checklist.md.

Validation

• normal Rust workspace tests: 276 passed, 2 ignored; engine: 116 passed
• managed-runtime Rust workspace tests: 275 passed, 2 ignored; engine: 116 passed
• normal and managed-runtime Clippy with -D warnings
• 23 release/package contract unit tests
• Ruff format and lint for release tooling
• frontend production build
• Tauri managed-runtime debug shell build with the Linux config overlay (bundle generation skipped on the macOS development host)
• shell syntax, Tauri JSON, and workflow YAML parsing

Explicit remaining evidence

• GitHub's Ubuntu 22.04 runner must produce, audit, and smoke the actual AppImage.
• Ubuntu 22.04+ NVIDIA, real Wayland and Xorg, PipeWire/ALSA devices, FLX4 MIDI/audio routing, suspend/resume, and sustained inference tests require the hardware checklist; none are claimed here.
• Minimum NVIDIA driver and VRAM requirements remain unset until Add a production PyTorch MRT2 backend for Linux and Windows #110 qualification supplies measurements.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.