Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

install.sh

@@ -8,6 +8,8 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib/common.sh
 source "$SCRIPT_DIR/lib/common.sh"
+# shellcheck source=lib/distro.sh
+source "$SCRIPT_DIR/lib/distro.sh"
 # shellcheck source=lib/detect.sh
 source "$SCRIPT_DIR/lib/detect.sh"
 # shellcheck source=lib/preflight.sh
@@ -142,14 +144,14 @@ setup_install_log() {
 main() {
   setup_install_log
   require_not_root
-  require_arch
-  require_yay
+  require_supported_distro
 
   step "Detecting system"
   detect_all
   compute_stream_mode
   export STREAM_MODE
-  info "Host: $HOSTNAME_SHORT   GPU: $GPU_VENDOR   Session: $SESSION_TYPE"
+  info "Distro: $DISTRO ($DISTRO_ID ${DISTRO_VERSION:-})   Host: $HOSTNAME_SHORT"
+  info "GPU: $GPU_VENDOR   Session: $SESSION_TYPE   Compositor: $COMPOSITOR"
   info "Mode: $STREAM_MODE"
 
   if [[ $DOCTOR_ONLY -eq 1 ]]; then
@@ -160,6 +162,17 @@ main() {
   step "Preflight checks"
   preflight_all
 
+  # On headless mode, make sure we have a compositor we can drive. On Arch
+  # this is typically Hyprland (already on Omarchy); on Ubuntu we install Sway
+  # and switch COMPOSITOR before installing hooks.
+  if [[ "$STREAM_MODE" == "headless" && "$COMPOSITOR" == "none" ]]; then
+    step "Installing headless compositor"
+    install_headless_compositor
+    COMPOSITOR="$(detect_compositor)"
+    export COMPOSITOR
+    info "Compositor (after install): $COMPOSITOR"
+  fi
+
   if [[ $INSTALL_SUNSHINE -eq 1 ]]; then
     step "Installing Sunshine and GPU encoder support"
     install_sunshine