Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

lib/detect.sh

@@ -1,25 +1,47 @@
 #!/usr/bin/env bash
-# Detect GPU vendor, session type, hostname.
+# Detect GPU vendor, session type, hostname, compositor.
 
 detect_gpu_vendor() {
   local vga
   vga="$(lspci -nn 2>/dev/null | grep -iE 'vga|3d|display' || true)"
-  if grep -qi 'nvidia' <<<"$vga"; then
+  # Prefer the first discrete/dedicated entry — VM hosts often expose a
+  # placeholder BOCHS/QEMU VGA device before the real GPU.
+  local nvidia_line amd_line intel_line
+  nvidia_line="$(grep -i 'nvidia' <<<"$vga" | head -n1)"
+  amd_line="$(grep -iE 'amd|advanced micro devices|ati' <<<"$vga" | head -n1)"
+  intel_line="$(grep -i 'intel' <<<"$vga" | head -n1)"
+  if [[ -n "$nvidia_line" ]]; then
     echo "nvidia"
-  elif grep -qiE 'amd|advanced micro devices|ati' <<<"$vga"; then
+  elif [[ -n "$amd_line" ]]; then
     echo "amd"
-  elif grep -qi 'intel' <<<"$vga"; then
+  elif [[ -n "$intel_line" ]]; then
     echo "intel"
   else
     echo "unknown"
   fi
 }
 
+# Decide which wlroots-based compositor to drive for headless capture.
+# Returns one of:
+#   hyprland   - hyprctl available (preferred when present, matches existing hooks)
+#   sway       - sway/swaymsg available
+#   none       - neither installed yet (install_headless_compositor will fix this)
+detect_compositor() {
+  if command -v hyprctl >/dev/null 2>&1; then
+    echo "hyprland"
+  elif command -v swaymsg >/dev/null 2>&1 || command -v sway >/dev/null 2>&1; then
+    echo "sway"
+  else
+    echo "none"
+  fi
+}
+
 detect_all() {
   HOSTNAME_SHORT="$(hostname -s 2>/dev/null || hostname)"
   GPU_VENDOR="$(detect_gpu_vendor)"
   SESSION_TYPE="${XDG_SESSION_TYPE:-unknown}"
-  export HOSTNAME_SHORT GPU_VENDOR SESSION_TYPE
+  COMPOSITOR="$(detect_compositor)"
+  export HOSTNAME_SHORT GPU_VENDOR SESSION_TYPE COMPOSITOR
 
   if [[ "$SESSION_TYPE" != "wayland" ]]; then
     warn "Session type is '$SESSION_TYPE' (not wayland). KMS capture still works at the TTY/DRM level, but Hyprland-specific paths assume Wayland."