feat(linux): add .deb + AppImage builds, Linux CI, and sidecar resource_dir fix

[Nikish-codes]

What

Adds native Linux packaging (.deb + AppImage) to the release pipeline — currently macOS + Windows only. Closes the gap requested in #232, #171, #117, #414, #80.

Verified end-to-end on Ubuntu 24.04:

• OpenWorker_0.1.7_amd64.deb (79 MB) — installs and the app finds its sidecar at runtime
• OpenWorker_0.1.7_amd64.AppImage (157 MB)
• Backend suite: 1114 passed / 1 skipped · GUI unit: 108 passed · cargo build: warning-clean

Why a new PR (supersedes #173)

#173 ("Add Linux release artifacts: AppImage + .deb") is approved and well-scoped but has been open and stalled for ~2 weeks. I built it locally and it hits two correctness gaps that this PR fixes:

1. The deb builds but the app can't start (runtime sidecar resolution)

#173 bundles the sidecar via Tauri resources but does not touch server_bin() in src-tauri/src/lib.rs. That function resolves the sidecar next to the app binary — correct on macOS (Contents/MacOS/ → Contents/Resources/) and Windows (resources unpack next to the exe), but wrong on a .deb: the binary lives in /usr/bin/ and resources land under /usr/lib/OpenWorker/ (Tauri's resource_dir()). Without the fix the build is green but the app hangs on "Starting coworker…".

Fix: server_bin(app) resolves via app.path().resource_dir() on Linux (#[cfg(target_os = "linux")]). macOS/Windows paths are untouched.

Verified against the built deb:

$ dpkg-deb -c OpenWorker_0.1.7_amd64.deb | grep sidecar
-rwxr-xr-x  usr/lib/OpenWorker/sidecar/openworker-server

2. The STT sidecar doesn't compile in CI (missing build deps)

#173's apt list omits libasound2-dev (cpal → ALSA) and libclang-dev (whisper-rs-sys → bindgen), so cargo build fails on the ocw-stt crate. It also names the deprecated libappindicator3-dev instead of the libayatana-appindicator3-dev successor Tauri 2 needs. This PR includes the correct deps and a distro-aware installer helper.

What's in the PR

File	Change
packaging/build_linux.sh (new)	PyInstaller sidecar → stage at binaries/sidecar → tauri build --bundles deb,appimage. BUNDLES= overrides targets.
packaging/install_linux_deps.sh (new)	Distro-aware installer (Debian/Fedora/Arch) for the Tauri webkit GUI + ocw-stt build-time libs.
surfaces/gui/src-tauri/src/lib.rs	server_bin() takes AppHandle, resolves the sidecar via resource_dir() on Linux. Silences an unused_mut on non-macOS (the window builder is mut only inside the macOS title-bar cfg block).
.github/workflows/release.yml	ubuntu-22.04 matrix leg (stable glibc 2.35 for broad compat), Linux deps + build + staging steps, and a regression guard that fails CI if the deb ships without the sidecar at usr/lib/OpenWorker/sidecar/ — prevents the #173 bug class from recurring.
packaging/make_update_manifest.py	Registers OpenWorker-linux-amd64.deb as the linux-x86_64 updater target.
README.md	"Build a Linux package" section + packaging table entry. No download link (release timing is a maintainer call).

Scope deliberately kept out (follow-ups)

• Voice Input stays unsupported on Linux. The ocw-stt crate (cpal + whisper-rs) compiles on Linux, but the shell's voice_input_compatibility() gate is conservative by design. Wiring a real Linux audio backend is a natural follow-up — kept out of scope to keep this PR focused on packaging. (Add Linux support: AppImage distribution + voice input & keep-awake #19 explores this.)
• aarch64 — x86_64 only here; ci: run backend + GUI unit tests on Linux arm64 #218 covers Linux arm64 test CI.
• RPM / Flatpak / Snap — BUNDLES=rpm,appimage works if rpmbuild is installed; other formats are later.

How to verify locally

bash packaging/install_linux_deps.sh        # Tauri + STT build libs (distro-aware)
python3 -m venv .venv && .venv/bin/pip install -e '.[bedrock]' pyinstaller typer
cd surfaces/gui && npm ci && cd ../..
./packaging/build_linux.sh
# → surfaces/gui/src-tauri/target/release/bundle/{deb,appimage}/
sudo dpkg -i surfaces/gui/src-tauri/target/release/bundle/deb/OpenWorker_*.deb
openworker-desktop

Notes for maintainers

Happy to rework or narrow scope however fits your roadmap. If Linux is already under internal development (per the README note about the internal list), no worries — the server_bin() resource_dir() fix and the missing-deps findings may still save you the debugging round either way. I can also drop these fixes as review comments on #173 if you'd prefer to land it there instead of a new PR.

Refs: supersedes #173 · related #19 #78 #218 · demand #232 #171 #117 #414 #80