fix(linux): enforce reproducible AppImage build baseline

[FTHR-Community]

Summary

• build the AppImage compatibility job on Ubuntu 22.04 and reject any bundled ELF requiring newer than GLIBC 2.35
• scan both the complete AppDir and the final AppImage before creating the checksum
• pin appimagetool and the type-2 runtime by release, commit, exact size, and SHA-256
• revalidate cached tooling and use atomic replacement for downloads
• pass the verified runtime explicitly with --runtime-file
• include the runtime licence and enforce it in the release licence gate
• keep GitHub CI as build validation only; remove the workflow that published AppImages so users can build locally
• preserve the Linux uploader hash when Windows packaging refreshes its own release bindings
• make the Linux execute-bit contract test portable on Windows CI without weakening the production chmod path

This addresses the portability failure reported in #28 without changing the Linux capture implementation.

Validation

• AppImage/GLIBC/licence target tests: 64 passed, 2 skipped
• uploader boundary tests: 14 passed, 2 skipped
• Ruff: passed
• Python compileall: passed
• Bash syntax check: passed
• release licence gate: 68 checks, 0 failures, 2 expected missing-vendored-binary warnings
• git diff --check: passed

GitHub CI has physically completed the Ubuntu 22.04 AppImage package and GLIBC validation job successfully. Physical launch/capture validation on Linux hardware remains pending.

[kalopsia-space]

Reviewed PR #40 against linux. I found no blocking correctness or security issues in the changed files. The pinned AppImage tool/runtime inputs are verified by size and SHA-256 with atomic replacement; the AppImage is built with an explicit runtime and checked against the GLIBC_2.35 ceiling before checksum creation; the Windows manifest update preserves the Linux binding; and the release workflow removal matches the stated build-validation-only policy.

Verified: GitHub checks are passing (Linux AppImage, Linux/Windows engine, Python 3.12/3.14, release verification); mergeable; git diff --check and AST parsing pass locally. I could not run pytest locally because pytest is not installed in this environment. Approving based on the passing CI and code inspection.