Fix image runtime reliability, installer configuration, and verified updates

[tuxclaw]

TuxLinux could publish a successful image with missing development tools, an unwritable Flutter SDK, a stale verification key, and installer configuration targeting the upstream template. This PR fixes those paths and adds checks for the resulting behavior.

• Flutter now uses a checksum-verified image seed and a versioned, writable SDK per user. Starship is pinned and checksum-verified instead of installed through a mutable shell script.
• Required packages fail the build when unavailable. The image uses Fedora's current JDK; PipeWire/GBM development runs in a tested Fedora SDK container so it does not replace Bazzite's custom graphics stack. The old Fedora 43 RPM extraction is removed.
• Local build names are lowercase. Disk builds use the existing KDE config, an explicit Btrfs root, amd64 runners, distinct artifacts, and the TuxLinux installer/update origin. A shared local/CI helper supplies source-image RPM keys to the builder without disabling repository verification.
• Client signature policy is repository-scoped and preserves upstream rules. The committed public key now matches the existing CI signer and verifies the current published image. No signing secret was rotated. Publishing signs and verifies the pushed digest; CI checks key consistency.
• Documentation describes the actual NVIDIA-open/KDE/x86-64 support, verified migration, SDK use, rollback limits, and Apache-2.0 license.

Validation:

• Final container build and read-only, non-root runtime smoke test passed. Flutter/Dart start successfully and create a Linux project in writable user storage; bootc lint and required-tool/development checks pass.
• Source checks, native SDK compilation/linking, and signing-key consistency passed. Local actionlint, ShellCheck, Bash syntax, TOML parsing, and helper tests also passed.
• Installer ISO and QCOW2 builds passed. The only subsequent change is the Flutter smoke-test project name; disk build files are unchanged. GitHub automatically started another disk build on the final commit, which remains in progress.
• The corrected public key verifies the currently published image. The active CI private key was retained; no signing secret was rotated.

No host deployment or reboot was performed. Container smoke checks and disk artifact creation do not establish booted installer, Secure Boot, or NVIDIA hardware compatibility.