Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

lib/common.sh

@@ -29,34 +29,26 @@ require_not_root() {
   fi
 }
 
-require_arch() {
-  if [[ ! -f /etc/arch-release ]] && ! grep -q '^ID=arch' /etc/os-release 2>/dev/null; then
-    err "This script targets Arch Linux (Omarchy). /etc/arch-release not found."
-    exit 1
-  fi
-}
-
-require_yay() {
-  if ! command -v yay >/dev/null 2>&1; then
-    err "yay is required to install AUR packages. Install yay first."
-    exit 1
-  fi
-}
-
-# True if package is installed (pacman -Qi).
-pkg_installed() { pacman -Qi "$1" >/dev/null 2>&1; }
-
-# Install one or more packages via yay if any are missing.
+# Package management (pkg_installed, pkg_install, etc.) and distro detection
+# live in lib/distro.sh. Source it after this file.
+#
+# yay_install is kept as an alias for code paths that explicitly want AUR
+# packages even on a distro-agnostic call site (rare). On non-Arch distros it
+# falls back to pkg_install.
 yay_install() {
-  local missing=()
-  local p
-  for p in "$@"; do
-    pkg_installed "$p" || missing+=("$p")
-  done
-  if [[ ${#missing[@]} -eq 0 ]]; then
-    ok "Already installed: $*"
-    return 0
+  if [[ "${DISTRO:-}" == "arch" ]] && command -v yay >/dev/null 2>&1; then
+    local missing=()
+    local p
+    for p in "$@"; do
+      pkg_installed "$p" || missing+=("$p")
+    done
+    if [[ ${#missing[@]} -eq 0 ]]; then
+      ok "Already installed: $*"
+      return 0
+    fi
+    info "Installing (AUR): ${missing[*]}"
+    yay -S --needed --noconfirm "${missing[@]}"
+  else
+    pkg_install "$@"
   fi
-  info "Installing: ${missing[*]}"
-  yay -S --needed --noconfirm "${missing[@]}"
 }