desktop: prebuilt pacman package + verified .deb (tasks 2022, 2074)

Native packages the installer can actually fetch, before task 2014 wires up
the fetching.

Arch (task 2022, re-scoped): the source PKGBUILD is gone — asking every user
to install rust+node and compile for minutes isn't distribution. Replaced by
desktop/packaging/arch/package-prebuilt.sh, which wraps the binary the Linux
job already built into a .pkg.tar.zst. No second Rust build, no Arch CI image:
the binary bundles nothing and resolves webkit/gtk/soup by soname, identical
on both distros, with SQLite compiled in and glibc used in the safe
built-old/run-new direction. CI is Debian and has no pacman, so the step logs
.PKGINFO plus the full file listing for audit instead of pretending to verify.

Debian (task 2074): install.sh hands the .deb to every Debian/Ubuntu user and
nothing had ever inspected it. tauri.conf.json now declares
libwebkit2gtk-4.1-0 + libgtk-3-0 explicitly rather than trusting inference —
and deliberately declares no appindicator or sqlite dep, since tauri is built
with features=[] and rusqlite is "bundled". desktop/packaging/deb/verify.sh
prints the generated control file, cross-checks it against what the ELF
actually needs via dpkg-shlibdeps, confirms every declared dep exists in apt,
and clean-container installs when a docker CLI is available.

Both artifacts join the run artifact and the tagged release; install.sh grows
a pacman branch so Arch/CachyOS gets a native install instead of the AppImage
fallback. Still no release cut (rule 2).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

ci-requirements.md

@@ -59,8 +59,23 @@ backend/frontend push.
 - **Steps:** build the shared frontend (embedded by `generate_context!`) →
   `cargo tauri icon app-icon.png` (platform icon set from the committed 1024px
   source) → `cargo fmt --check` → `cargo clippy -D warnings` → `cargo test` →
-  `cargo tauri build` (produces `.deb` + `.AppImage`).
+  `cargo tauri build` (produces `.deb` + `.AppImage`) → de-bundle the AppImage's
+  graphics libs → verify the `.deb` → repackage for pacman.
 - **`APPIMAGE_EXTRACT_AND_RUN=1`** is set: AppImage tooling FUSE-mounts by default
   and CI containers have no `/dev/fuse`.
+- **Packaging tools used from the image** (none installed at job time, rule 5):
+  `dpkg-deb` / `dpkg-query` / `apt-cache` and `dpkg-shlibdeps` (from `dpkg-dev`,
+  pulled in by `build-essential`) for `desktop/packaging/deb/verify.sh`; `tar` +
+  a compressor for `desktop/packaging/arch/package-prebuilt.sh`. Both scripts
+  degrade gracefully rather than hard-failing on an absent optional tool:
+  `bsdtar` (`libarchive-tools`) is used for the pacman package's `.MTREE` when
+  present and skipped when not, compression falls back zstd → xz → gzip, and the
+  `.deb` clean-container install test runs only if a docker CLI is available.
+  Adding `libarchive-tools` + `zstd` + a docker CLI to `ci-tauri` would upgrade
+  those degraded paths, but none of them block a green build.
+- **Not verifiable in CI:** the runner is Debian, so the pacman package cannot be
+  `pacman -U`-tested here. That step logs `.PKGINFO` + the full file listing so
+  the package is auditable from the run log; a real Arch install is the operator's
+  confirm.
 - No Postgres lane (unchanged): the desktop app's local store + sync behavior is
   verified on the operator's machine, not in CI.