Linux build support + cross-platform brew hardening

[msitarzewski]

Adds Linux as a build target alongside macOS. Verified end-to-end on arm64 Ubuntu 26.04 (in a Parallels VM): builds .deb/.rpm/.AppImage, installs the .deb, launches into a GNOME/Wayland session, detects Linuxbrew, and loads packages. macOS regression-clean — 586 tests pass, cargo check clean, npm run check 0 errors.

Backend

• keyring per-target Cargo features: macOS apple-native; Linux sync-secret-service + crypto-rust (Secret Service via gnome-keyring/kwallet, pure-Rust crypto so no system OpenSSL). github/auth.rs unchanged — unified keyring::Entry API.
• brew/paths.rs: detect Linuxbrew prefixes (/home/linuxbrew/.linuxbrew, ~/.linuxbrew).
• brew/exec.rs: pin every brew subprocess to a known-readable cwd (/). Fixes "current working directory must be readable" failures (surfaced on Linux as "Couldn't load packages" when launched from an unreadable dir). Hardening on macOS too.
• disk_usage.rs: open_in_finder reveal cfg-gated — macOS open -R, Linux xdg-open on parent dir. IPC name unchanged.
• cask_icon.rs: macOS .app/sips/defaults extraction cfg-gated; Linux short-circuits to Ok(None) (homepage-favicon cascade still works).
• lib.rs: native menu gated to macOS (on Linux/GTK it rendered as an in-window menubar strip clashing with the transparent window; Linux now gets a clean chromeless window).

Frontend

• platform.ts — navigator-based isMac/isLinux, zero new deps.
• "Reveal in Finder" → "Show in file manager"; "macOS Keychain" → "system keyring" on Linux.

Packaging / CI

• .github/workflows/linux-build.yml — ubuntu-22.04 (webkit2gtk-4.1, oldest-glibc floor), builds + uploads .deb/.rpm/.AppImage.
• tauri.conf.json linux bundle config; tauri.linux.conf.json sets transparent:false. macOS bundle untouched.
• publish-manifest.sh emits a linux-x86_64 updater block when the AppImage + .sig are present; macOS-only path byte-identical otherwise.

Known gaps (honest)

• Casks unsupported on Linux (brew vulns + cask icons are formula/macOS-only) — UI states this rather than faking it.
• Linux artifacts ship unsigned for v0 (AppImage convention; deb/rpm GPG signing is a documented future step).
• Two post-launch bug fixes ride along: the brew-cwd fix above, and the transparent-menubar fix — both found via live VM testing.

Test plan

• CI linux-build.yml goes green, produces the three artifacts
• macOS: cargo test (586), npm run check (0 err), app launches normally
• (done locally) Linux arm64: install .deb, launch, brew detected, package list loads

🤖 Generated with Claude Code