Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

files/sway-headless.config

@@ -0,0 +1,30 @@
+# Minimal sway config for a headless Sunshine host. Installed by
+# omarchy-moonlight as ~/.config/sway/config-headless. Loaded by the
+# sway-headless.service systemd-user unit on Debian/Ubuntu installs.
+#
+# Goals:
+#   - Boot sway with a single headless output named HEADLESS-1 so Sunshine's
+#     wlr capture has a stable target.
+#   - No keybindings, no bars, no animations. There's no human at the console.
+#   - The sunshine-stream-do-sway.sh hook adjusts HEADLESS-1's mode per client
+#     connect; this config is just the boot-time baseline.
+
+# Create the headless output at startup. Sway accepts `output HEADLESS-1
+# enable` only after the output exists, so we issue create_output here.
+exec swaymsg create_output HEADLESS-1
+
+# Default mode — overridden per-connect by the do-hook.
+output HEADLESS-1 mode 1920x1080@60Hz
+output HEADLESS-1 background #1a1a1a solid_color
+
+# No idle locking on a headless box; no XWayland (would just waste DRM resources).
+xwayland disable
+
+# Don't enable animations / focus-follow / etc — there's no user input here.
+focus_follows_mouse no
+default_border none
+default_floating_border none
+
+# A minimal placeholder so sway has something to display. The actual stream
+# content lives in whatever app the user launches via sunshine commands.
+exec --no-startup-id true