feat: add Linux desktop packaging (deb) support

[ChrisLou-bioinfo]

Summary

Adds the missing pieces to build and run the Rho desktop app on Linux, producing a .deb bundle via Tauri.

• desktop/src-tauri/tauri.linux.conf.json (new): deb target, Ark runtime resources, license files, icons, r-base-core recommend
• Ark runtime: resolve the bundled Ark executable on Linux in ark_candidate_paths; add linux-x64 / linux-arm64 entries (official posit-dev release checksums) to runtime/ark.json
• Webview rendering: default WEBKIT_DISABLE_DMABUF_RENDERER=1 on Linux — on NVIDIA proprietary graphics stacks WebKitGTK fails GBM buffer allocation (Failed to create GBM buffer ... Permission denied) and the webview paints nothing; the env var is respected if already set
• Credentials: store agent provider API keys through the Secret Service keyring on Linux (dbus-secret-service-keyring-store), previously hard-unavailable on this platform
• Project scan robustness: skip unreadable/unstat-able entries during project file scans instead of failing the whole project switch (e.g. root-owned cache directories under $HOME); log the project restore failure detail to the startup log

Test plan

• cargo tauri build --config tauri.linux.conf.json on Ubuntu 24.04 arm64 (DGX Spark, R 4.6.1, ark 0.1.252 linux-arm64, Rust 1.97.0)
• Fresh apt install of the produced deb (auto-resolved webkit2gtk/libgtk deps); app launches with full IDE UI
• Ark R session starts; editor Ctrl+Enter run executes and Console shows output (21*2 → [1] 42)
• Model settings saves/reuses an API key via gnome-keyring; model discovery + import against a local OpenAI-compatible endpoint works; agent chat round-trips through it
• x86_64 Linux build validation
• Follow-ups per governance (proposal doc, NEWS entry) if the approach is accepted

🤖 Generated with Claude Code

[xiayh17]

I reviewed PR #79 and am requesting changes.

The main blocker is scope/contract: the active Linux plan and cross-review still explicitly defer .deb/.rpm packaging and Linux arm64. This PR turns both on without amending/authorizing the active contract first, and the PR body leaves proposal/NEWS work as follow-up even though this repo treats those as gates for non-trivial product behavior.

I also found concrete packaging/runtime gaps around the ignored resources/runtime/ark path and the arm64 sidecar lane, plus one project-scan robustness hole. Verification I ran locally: git diff --check, node scripts/test-desktop-platform-config.mjs, node scripts/test-installed-license-surface.mjs, focused cargo test -p rho-desktop ark_lookup_, and focused project scan tests. Full cargo test -p rho-desktop reached 176 passed / 4 failed / 1 ignored; the 4 failures were sandbox TcpListener::bind("127.0.0.1:0") permission errors in existing agent discovery tests, not in the changed paths.

[GuangchuangYu]

All four review comments are addressed on branch linux-support-forkmain (commits 47973a7 + merge 5a07cd4):

1. deb target vs active contract → contract amended and authorized 2026-08-20 (linux-appimage-support amendment + cross-review updated)
2. bundled resources/runtime/ark → staged and checksum-verified by prepare-runtime-resources.sh from the checked sidecar
3. linux-arm64 staging lane → bootstrap-ark-linux.sh / prepare-runtime-resources.sh consume the linux-arm64 manifest entry; main.rs aarch64 candidates include the development sidecar
4. project.rs per-entry errors → skipped/logged via collect_dir_entries, regression test added

Verified locally: cargo test -p rho-desktop 206 passed / 0 failed / 1 ignored, project:: 26 passed, ark_lookup_ 4 passed, cargo fmt --all -- --check clean, Ark bootstrap fixtures + test-linux-apprun.sh pass, git diff --check clean. @xiayh17 please re-review when convenient.

[xiayh17]

Reviewed the fix commit 5a07cd4. All four original CHANGES_REQUESTED items are resolved:

1. deb contract authority — active-2026-08-11-linux-appimage-support.md amended on 2026-08-20 to authorize the deb target; cross-review updated to remove the .deb/.rpm deferral. .rpm, arm64 AppImage/deb packaging, and automatic Linux updates remain deferred.
2. Bundled resources/runtime/ark checksum-verified — prepare-runtime-resources.sh now stages the checked sidecar into desktop/resources/runtime/ark with atomic partial-file replacement and post-copy SHA256 verification, instead of packaging whatever ignored file happens to exist.
3. linux-arm64 staging lane — bootstrap-ark-linux.sh and prepare-runtime-resources.sh are now arch-aware (x86_64 + aarch64), consuming the runtime/ark.json linux-arm64 entry with arch-specific ELF verification and runtime dir. main.rs linux/aarch64 candidate list now includes the development sidecar. Fixture tests cover arm64 ELF rejection and unsupported-arch rejection.
4. project.rs per-entry error handling — collect_dir_entries helper now skips and logs individual read_dir errors instead of propagating them via collect::<Result<Vec>>()?. Per-entry file_type(), canonicalize(), metadata(), and relative_project_path() failures all continue instead of failing the scan. Regression test added.

The DMABUF renderer workaround (WEBKIT_DISABLE_DMABUF_RENDERER=1 default on Linux) and project scan robustness improvements are clean and well-tested. The build lane pinning (--bundles appimage) correctly prevents the AppImage lane from accidentally producing an unverified deb.

Remaining follow-up: NEWS.md entry for the .deb Linux packaging support should be added before release (not a merge blocker for the code changes themselves).