feat(packaging): the trial's Linux column and the Linux packages (P11a steps 1 and 3)

The Linux half of the packaging trial, run on this machine and in Debian,
Fedora and Arch containers, and the recipes it produced (docs/packaging.md
holds the table and what it found):

- mise.toml pins cargo-packager 0.11.8 and cargo-generate-rpm 0.21.1, now
  that `just package-linux` calls them. cargo-packager-updater is a
  library, not a tool, so it is not pinned (update.rs does the checking
  with minisign-verify, which is what the updater uses).
- deploy/packaging/: packager.toml (.deb, AppImage, the pacman tarball and
  its PKGBUILD), the rpm table in crates/ledger-cli/Cargo.toml, the AUR's
  own PKGBUILD (repacks the release tarball), build-linux.sh,
  repo-indexes.sh (the apt and dnf indexes, unsigned until the signing
  step), local-release.sh (a throwaway-keyed feed to try `update`),
  test-linux-packages.sh (linux_packages_install_and_upgrade: install
  0.1.0, open books as an ordinary user, upgrade to 0.1.1, check the host
  restarted onto the new file, the books' last journal line unchanged and
  `update` refuses; passes on Debian trixie, Fedora and Arch). A package
  marks itself package-managed with share/wanderbooks/install-method.
- The icon is a placeholder square (the AppImage cannot be built without
  one).
- .github/workflows/release.yml: on a version tag, build on ubuntu-24.04
  (the oldest glibc the packages claim: a program linked on this machine
  needs GLIBC_2.43 and does not start on Debian 13), attach the packages to
  the release, and add them to the apt and dnf repositories on gh-pages.
  No signing and no macOS or Windows job yet.
- The release profile strips symbols.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

justfile

@@ -263,3 +263,35 @@ deploy: site
 # Deploy a preview of the website and print its URL
 deploy-preview: site
     {{netlify}} deploy --dir site/dist --no-build
+
+# The Linux packages (P11a step 3), in target/packages/VERSION. Builds the
+# release program first; needs the tools `mise install` pins. A VERSION other
+# than the program's repackages the same program under it (the upgrade
+# test's second release).
+# Build the AppImage, .deb, pacman tarball and .rpm
+package-linux version="" formats="deb,appimage,pacman":
+    cargo build --release -p ledger-cli
+    deploy/packaging/build-linux.sh {{version}} {{formats}}
+
+# A release folder on this machine signed with a throwaway key; then
+# `wanderbooks update --feed file://DIR/manifest.json --trusted-key DIR/release.pub`
+# Make a local release feed to try `wanderbooks update` against
+local-release file version dir:
+    deploy/packaging/local-release.sh {{file}} {{version}} {{dir}}
+
+# A program linked here does not start on Debian (docs/packaging.md); this
+# builds it in rust:1.99-trixie, into target/container. Needs docker.
+# Build the release program in a Debian trixie container
+release-trixie:
+    mkdir -p target/container
+    docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp -e CARGO_HOME=/tmp/cargo-home -e CARGO_TARGET_DIR=/target -v "$PWD:/src:ro" -v "$PWD/target/container:/target" -w /src rust:1.99-trixie cargo build --release --locked -p ledger-cli
+
+# Install each Linux package in a clean Arch, Debian and Fedora container,
+# open the books, upgrade to the next release, and check the books' head is
+# unchanged and the open books restarted onto the new program. Builds the
+# program in a trixie container, then releases 0.1.0 and 0.1.1 of it.
+# Install and upgrade the Linux packages in Arch, Debian and Fedora containers
+test-linux-packages: release-trixie
+    WB_PROGRAM=target/container/release/wanderbooks deploy/packaging/build-linux.sh 0.1.0 deb,pacman
+    WB_PROGRAM=target/container/release/wanderbooks deploy/packaging/build-linux.sh 0.1.1 deb,pacman
+    deploy/packaging/test-linux-packages.sh