Linux: support verified user-space updates for .deb installs without root

## Problem

Buzz correctly avoids invoking Tauri's AppImage-only updater for `.deb` installs (#1535). The remaining experience is a generic GitHub Releases link. That leaves Linux users who installed the official `.deb` without root/package-manager ownership to manually choose, verify, unpack, replace, and restart every release.

This is especially awkward for workstation and self-hosted deployments where the desktop app is installed under the user's XDG directories rather than system-wide.

## Proposed direction

Add an optional, distribution-neutral user-space installer/updater for the official Linux `.deb` artifact. It could be a maintained script first, with the desktop UI invoking it only when the installation is explicitly identified as user-managed.

The implementation should:

- use XDG paths (`XDG_DATA_HOME`, `XDG_CACHE_HOME`, `XDG_STATE_HOME`) rather than a username or fixed home path;
- query only the official `block/buzz` stable release endpoint;
- require a `desktop-vX.Y.Z` tag and the exact architecture-specific asset;
- verify the release asset's GitHub-provided SHA-256 digest before extraction;
- validate package version, architecture, executable format, and required shared libraries;
- install versions side-by-side and atomically switch a `current` symlink;
- preserve the existing profile and OS keyring data;
- retain one previous version and automatically roll back if the new binary cannot start;
- use no relay URL, identity, credential, or deployment-specific default;
- serialize concurrent updates and fail without replacing the current install.

## Non-goals

- replacing apt/dnf/Flatpak/AppImage package management;
- auto-updating a system-owned `/usr` installation;
- running privileged commands or asking for sudo;
- changing Buzz identity or community configuration.

## Prior validation

I have a working operator prototype of the download → digest verification → side-by-side extraction → atomic switch → restart/rollback flow. It is currently deployment-specific, so I am not submitting that version. I can generalize it around XDG directories, remove all deployment assumptions, add shell tests around release parsing/rollback, and send a focused PR if this is a direction maintainers want.

## Alternatives

1. Document AppImage as the only self-updating Linux install.
2. Publish an apt repository and keep `.deb` lifecycle entirely in apt.
3. Add Flatpak and delegate updates to the Flatpak runtime.

The user-space updater is useful only if Buzz wants the official `.deb` to remain usable without root or a configured package repository.