Linux Distribution

Linux distribution: .deb + AppImage (#57)

* feat(build): add Linux AppImage target

Adds Linux to the distribution matrix alongside Windows and macOS.

- electron-builder: AppImage target, executableName "smiled" (productName
  "smile:D" is not a valid Linux executable name or .desktop Exec entry)
- icons: generate-icons.mjs now emits build/icons/<size>x<size>.png, since
  electron-builder derives the hicolor size from the filename — a plain
  icon.png lands in hicolor/0x0/ and the desktop entry never resolves
- updates: skip the update check on Linux outside an AppImage, where
  electron-updater cannot update and would surface a raw error
- CI: release on ubuntu-latest
- README: Linux install and build instructions

Verified on Linux x64: AppImage builds, launches, and renders the app shell.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(build): make the Linux AppImage launch, and add a sandboxed .deb

The AppImage aborted on launch with "no usable sandbox": an AppImage is a
read-only mount, so chrome-sandbox cannot be setuid root, and on Ubuntu 23.10+
AppArmor also restricts the unprivileged user namespace fallback.

--no-sandbox has to be set before the process starts, so neither the .desktop
Exec line (AppRun execs the binary with no arguments on a direct launch) nor
app.commandLine.appendSwitch reaches it in time. An afterPack hook therefore
wraps the executable in a launcher that adds the flag only when $APPIMAGE is
set.

The .deb keeps a real sandbox — its postinst installs a setuid chrome-sandbox —
so it is now built alongside the AppImage and is the recommended install.

Verified on Linux x64: the AppImage launches and renders the app shell, while
the same binary without $APPIMAGE still requires the setuid sandbox.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(connectors): copy bundled connectors out of the asar archive

fs.cpSync is not asar-aware, so installing a bundled connector from a
packaged build failed with ENOTDIR after creating the destination
directory. The empty directory then made discover() skip the connector
and every later install attempt report 'already installed'.

Copy the connector with asar-aware fs calls instead, clean up the
destination if the copy fails, and treat a manifest-less directory as
debris from an interrupted install rather than an installed connector.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>