native: validate the Linux AppImage release and updater end to end

Context

#5556 merged the x86_64 Linux AppImage build, updater channel, installer, download surface, FUSE org filesystem, and Linux CI. Passing CI proves buildability and headless boot, but not the complete production path on a real desktop.

The first merge-triggered release is https://github.com/decocms/studio/actions/runs/32299482446.

Acceptance checklist

• Verify the published release contains the versioned Linux x86_64 AppImage, checksum/signature material, and a Linux entry in latest.json.
• Install through the production web/download and install.sh paths, then launch the installed AppImage.
• Smoke Ubuntu 22.04 and 24.04 on a real graphical session; record desktop environment, WebKitGTK version, and required host packages.
• Verify sign-in and persistence with an available desktop credential service.
• Verify the keychain-unavailable recovery UI when no credential service is available.
• Start and stop a sandbox, load its preview, and verify restart/cleanup.
• Verify org/ over FUSE with fusermount3 present.
• Verify the missing-FUSE-helper failure is bounded and actionable.
• Publish a subsequent Linux release and prove an installed N updates to N+1, including signature verification, staged install, quit/restart, and version reporting.
• Record the tested support matrix and link it from the Linux documentation issue.

Exit criterion

Linux can be called beta-supported when first-install and real-desktop smoke pass. It can be called updater-supported only after a real N -> N+1 release succeeds.

Start with the first merge-triggered release at the linked GitHub Actions run, then follow the production web/download and install.sh paths on Ubuntu 22.04 and 24.04. Work through the acceptance checklist, including desktop credentials, FUSE, sandbox lifecycle, and a real N to N+1 update. Done means the support matrix is recorded, Linux beta and updater criteria pass, and the results are linked from the Linux documentation issue.