desktop: drop the redundant deb depends, correct the pacman docs

Follow-up to 8a8b2b1, driven by what run 2872's new checks actually printed.

The .deb verification did its job on its first run: tauri already infers
exactly libwebkit2gtk-4.1-0 + libgtk-3-0, so declaring the same two in
tauri.conf.json produced a control file listing each of them twice. Removed
the declaration — verify.sh is the real guard, and it fails the build if
inference ever stops covering what the binary links.

The pacman step revealed ci-tauri carries neither zstd nor bsdtar, so packages
currently ship as .pkg.tar.xz with no .MTREE. Both are working outcomes
(pacman reads xz; only `pacman -Qkk` needs .MTREE), but the docs promised
.zst, so the README, the release notes and ci-requirements.md now describe
what the build actually produces.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

.forgejo/workflows/desktop.yml

@@ -81,9 +81,13 @@ jobs:
       # install.sh hands the .deb to every Debian/Ubuntu user, so the package's
       # Depends must be right BEFORE a release exists. Prints the generated
       # control file and cross-checks it against what the ELF actually needs
-      # (dpkg-shlibdeps). tauri.conf.json declares libwebkit2gtk-4.1-0 + libgtk-3-0
-      # explicitly rather than trusting inference alone; there's deliberately no
-      # appindicator or sqlite dep (tauri features = [], rusqlite is "bundled").
+      # (dpkg-shlibdeps).
+      #
+      # We deliberately do NOT set bundle.linux.deb.depends: run 2872 showed
+      # tauri already infers exactly libwebkit2gtk-4.1-0 + libgtk-3-0, so
+      # declaring them again only produced a control file listing each twice.
+      # This step is the guard instead — if tauri's inference ever stops
+      # covering what the binary links, the build fails here.
       - name: Verify the .deb
         run: bash desktop/packaging/deb/verify.sh