Pin linuxdeploy/AppRun/plugin downloads by digest (supply chain + reproducibility)

During `pnpm tauri build`, the bundler fetches at build time:
- `github.com/tauri-apps/binary-releases/releases/download/linuxdeploy/linuxdeploy-x86_64.AppImage`
- `.../apprun-old/AppRun-x86_64`
- `raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.sh`
- `raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gstreamer/master/linuxdeploy-plugin-gstreamer.sh`
- `github.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/…`

All of these are mutable references (`master`, `continuous`, re-uploadable release assets) resolved
at release-build time. Anyone who can move those upstream tags injects content into a Buzz release
build, and two builds of the same tag can legitimately differ. The workflow already digest-pins
appimagetool 1.9.1 and the type2 runtime — the same treatment (vendor or verify by sha256) should
cover these. (In my v0.5.18 rebuild they happened to still deliver compatible bytes — the final
artifacts weren't affected — but that's luck, not policy.)

Start with the build workflow and the bundler path exercised by `pnpm tauri build`; trace where the listed linuxdeploy, AppRun, GTK, GStreamer, and appimage downloads are configured, alongside the existing appimagetool and type2 digest pins. Done means every listed download is vendored or sha256-verified so repeated builds cannot follow mutable upstream references.

Written by the indexing model from the issue text.