feat(linux): add .deb + AppImage builds, Linux CI, and sidecar resource_dir fix

[niutech]

Add native Linux packaging to the release pipeline (currently macOS + Windows only). Verified end-to-end: builds a working OpenWorker_0.1.7_amd64.deb (79M) and OpenWorker_0.1.7_amd64.AppImage (157M); backend suite 1114 passed / 1 skipped, GUI unit 108 passed, cargo warning-clean.

Supersedes andrewyng#173 (same goal, approved but stalled). Two correctness gaps in andrewyng#173 that this addresses:

1. Runtime sidecar resolution — Add Linux (Ubuntu) release artifacts: AppImage + .deb andrewyng/openworker#173 bundles but does NOT fix server_bin(), so on a .deb install the app cannot find its sidecar: macOS/Windows resolve it next to the binary, but a .deb puts the binary in /usr/bin and resources under /usr/lib/OpenWorker/ (Tauri's resource_dir()). Without the fix the build is green but the app hangs on "Starting coworker…". Fixed: server_bin(app) resolves via app.path().resource_dir() on Linux (#[cfg(target_os = "linux")]); macOS/Windows paths unchanged. Verified against the deb's contents (sidecar at usr/lib/OpenWorker/sidecar/).

2. Build deps — Add Linux (Ubuntu) release artifacts: AppImage + .deb andrewyng/openworker#173 omits libasound2-dev (cpal/ALSA) and libclang-dev (whisper-rs bindgen), so the STT sidecar crate fails to compile in CI, and uses the deprecated libappindicator3-dev. This uses the ayatana successor and includes the STT build deps.

Changes:

• packaging/build_linux.sh: PyInstaller sidecar -> stage at binaries/sidecar ->
  tauri build --bundles deb,appimage. Unsigned; BUNDLES= overrides targets.
• packaging/install_linux_deps.sh: distro-aware installer (Debian/Fedora/Arch) for the Tauri webkit GUI + ocw-stt (cpal/ALSA, whisper.cpp, libclang) libs.
• src-tauri/src/lib.rs: server_bin() takes AppHandle and resolves the sidecar via resource_dir() on Linux; silence an unused_mut on non-macOS (the window builder is mut only inside the macOS title-bar cfg block).
• .github/workflows/release.yml: ubuntu-22.04 matrix leg (stable glibc for broad compat), Linux deps step, build step, deb/AppImage staging, and a regression guard that fails CI if the deb ships without the sidecar at usr/lib/OpenWorker/sidecar/ (prevents the Add Linux (Ubuntu) release artifacts: AppImage + .deb andrewyng/openworker#173 bug class recurring).
• packaging/make_update_manifest.py: register OpenWorker-linux-amd64.deb as the linux-x86_64 updater target.
• README: "Build a Linux package" section + packaging table entry.

Notes:

• Voice Input is marked unsupported on Linux for now (the STT crate compiles on Linux, but the shell's compatibility gate is conservative by design); wiring a Linux audio backend is a natural follow-up, kept out of scope here.
• Built on ubuntu-22.04 (glibc 2.35) so the artifacts run on 22.04+ and most derivatives. aarch64 is a follow-up (ci: run backend + GUI unit tests on Linux arm64 andrewyng/openworker#218 covers Linux arm64 test CI).
• Unsigned: Linux has no universal code-signing scheme; auto-update artifacts emit only when TAURI_SIGNING_PRIVATE_KEY is set, same as the other targets.

Refs: andrewyng#173 (supersedes), andrewyng#19, andrewyng#78, andrewyng#218. Demand: andrewyng#232 andrewyng#171 andrewyng#117 andrewyng#414 andrewyng#80.