Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

lib/headless.sh

@@ -3,27 +3,52 @@
 # location and ensure they're executable. The actual sunshine.conf entries
 # (capture=wlr, output_name=HEADLESS-1, global_prep_cmd=[...]) are written
 # by lib/config.sh.
+#
+# Two compositor backends supported:
+#   - hyprland (default on Omarchy/Arch): bin/sunshine-stream-{do,undo}.sh
+#   - sway     (default on Debian/Ubuntu): bin/sunshine-stream-{do,undo}-sway.sh
+# detect_compositor (lib/detect.sh) decides which to install. The script names
+# at the install target are *always* sunshine-stream-do.sh / -undo.sh, so the
+# rest of the installer (config.sh, verify.sh) doesn't have to branch.
 
 HEADLESS_BIN_DIR="$HOME/.local/share/omarchy-moonlight/bin"
 
 DO_SCRIPT="$HEADLESS_BIN_DIR/sunshine-stream-do.sh"
 UNDO_SCRIPT="$HEADLESS_BIN_DIR/sunshine-stream-undo.sh"
-export DO_SCRIPT UNDO_SCRIPT
+PRESTART_SCRIPT="$HEADLESS_BIN_DIR/sunshine-prestart.sh"
+export DO_SCRIPT UNDO_SCRIPT PRESTART_SCRIPT
+
+# Resolve which hook source files to install based on the detected compositor.
+_headless_hook_sources() {
+  case "${COMPOSITOR:-hyprland}" in
+    sway)
+      echo "$SCRIPT_DIR/bin/sunshine-stream-do-sway.sh"
+      echo "$SCRIPT_DIR/bin/sunshine-stream-undo-sway.sh"
+      echo "$SCRIPT_DIR/bin/sunshine-prestart-sway.sh"
+      ;;
+    hyprland|*)
+      echo "$SCRIPT_DIR/bin/sunshine-stream-do.sh"
+      echo "$SCRIPT_DIR/bin/sunshine-stream-undo.sh"
+      echo "$SCRIPT_DIR/bin/sunshine-prestart.sh"
+      ;;
+  esac
+}
 
 install_headless_hooks() {
-  # Install hook scripts to ~/.local/share so they don't disappear if the
-  # repo gets moved or deleted. Sunshine's config will reference these stable paths.
   mkdir -p "$HEADLESS_BIN_DIR"
-  install -m 0755 "$SCRIPT_DIR/bin/sunshine-stream-do.sh"   "$DO_SCRIPT"
-  install -m 0755 "$SCRIPT_DIR/bin/sunshine-stream-undo.sh" "$UNDO_SCRIPT"
-  install -m 0755 "$SCRIPT_DIR/bin/sunshine-prestart.sh"    "$HEADLESS_BIN_DIR/sunshine-prestart.sh"
-  ok "Installed prep-cmd + prestart hooks to $HEADLESS_BIN_DIR"
+  mapfile -t srcs < <(_headless_hook_sources)
+  local do_src="${srcs[0]}" undo_src="${srcs[1]}" pre_src="${srcs[2]}"
+
+  install -m 0755 "$do_src"   "$DO_SCRIPT"
+  install -m 0755 "$undo_src" "$UNDO_SCRIPT"
+  install -m 0755 "$pre_src"  "$PRESTART_SCRIPT"
+  ok "Installed prep-cmd + prestart hooks ($COMPOSITOR) to $HEADLESS_BIN_DIR"
 }
 
 # Install a systemd-user drop-in that pre-creates HEADLESS-1 before Sunshine
-# starts, so the encoder probe at startup sees a valid Wayland output. Without
-# this, Sunshine reports a fatal "Unable to find display or encoder during
-# startup" on every restart, even though streaming works once a client connects.
+# starts. Without this, Sunshine reports a fatal "Unable to find display or
+# encoder during startup" on every restart, even though streaming works once
+# a client connects.
 install_headless_prestart_dropin() {
   local dropin_src="$SCRIPT_DIR/files/headless-prestart.conf"
   if [[ ! -f "$dropin_src" ]]; then
@@ -31,8 +56,9 @@ install_headless_prestart_dropin() {
     return 1
   fi
 
-  # Resolve the actual unit name. Prefer sunshine.service when present (alias
-  # or sunshine-bin); fall back to the AUR source pkg's reverse-DNS name.
+  # Resolve the actual unit name. Prefer sunshine.service when present (alias,
+  # sunshine-bin, or the .deb on Ubuntu); fall back to the AUR source pkg's
+  # reverse-DNS name.
   local unit=""
   for u in sunshine.service app-dev.lizardbyte.app.Sunshine.service; do
     if systemctl --user list-unit-files "$u" >/dev/null 2>&1 \