desktop AppImage: de-bundle host-coupled graphics libs (fixes black window)

Tauri's AppImage bundles the build host's graphics/display stack
(libEGL/libGL/libdrm/libgbm/libwayland-* + Mesa dri drivers) into usr/lib.
On many end-user systems (Arch/CachyOS, NVIDIA, Wayland) those clash with
the running kernel driver + Mesa and abort with EGL_BAD_PARAMETER -> a black
window (issue 2021). They load before any renderer choice, so the runtime
env fallbacks can't rescue it; per the AppImage excludelist they must come
from the host.

Add a CI-only post-build step (desktop/packaging/appimage/debundle-graphics.sh)
that extracts the built AppImage, strips exactly that graphics/display subset
(keeping webkit/gtk bundled for portability), and repackages in place so the
app falls through to the system's graphics libs. Wired into desktop.yml
between the Tauri build and the artifact upload.

Task 2023. Makes the AppImage the zero-install taste-test vehicle.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

.forgejo/workflows/desktop.yml

@@ -62,6 +62,15 @@ jobs:
         run: cargo tauri build --config '{"build":{"beforeBuildCommand":""}}'
         working-directory: desktop/src-tauri
 
+      # Tauri's AppImage bundles the build host's graphics/display libs
+      # (libEGL/libGL/libdrm/libgbm/libwayland-*), which clash with end-user GPU
+      # drivers and abort to a black window (EGL_BAD_PARAMETER, issue 2021).
+      # Strip that host-coupled stack so the app uses the running system's
+      # graphics libs; webkit/gtk stay bundled. Runs from the repo root (the
+      # script resolves its own paths), overwriting the AppImage in place.
+      - name: De-bundle AppImage graphics libraries
+        run: bash desktop/packaging/appimage/debundle-graphics.sh
+
       # Make the built .deb + .AppImage downloadable from the run (for hand-testing).
       # continue-on-error: the Forgejo artifact backend may not be configured yet; a
       # failed upload must not fail the build itself.