Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

lib/preflight.sh

@@ -35,7 +35,22 @@ preflight_gpu() {
   case "$GPU_VENDOR" in
     nvidia)
       if ! command -v nvidia-smi >/dev/null 2>&1; then
-        warn "nvidia-smi not found yet — nvidia-utils will be installed shortly."
+        case "$DISTRO" in
+          arch)
+            warn "nvidia-smi not found yet — nvidia-utils will be installed shortly."
+            ;;
+          debian)
+            # On Ubuntu the NVIDIA driver install isn't our job; we don't pull
+            # in nvidia-driver-* because the right version depends on the
+            # kernel / Secure Boot / cloud-vendor combo. Tell the user.
+            err "nvidia-smi not found and no NVIDIA kernel module loaded."
+            err "Install the driver before re-running this installer. Common paths on Ubuntu:"
+            err "    sudo ubuntu-drivers install   # picks the recommended branch"
+            err "    sudo apt install nvidia-driver-550-server   # explicit pin"
+            err "Then reboot (or modprobe nvidia) so 'nvidia-smi -L' returns the GPU."
+            exit 1
+            ;;
+        esac
         return 0
       fi
       if ! nvidia-smi -L >/dev/null 2>&1; then
@@ -53,7 +68,7 @@ preflight_gpu() {
       fi
       ;;
     intel)
-      ok "Intel GPU — will install intel-media-driver"
+      ok "Intel GPU — encoder packages will be installed in the packages step."
       ;;
   esac
 }
@@ -100,30 +115,41 @@ preflight_audio() {
 
 preflight_headless() {
   # Only relevant in headless mode. Checks are non-fatal: install can proceed
-  # even if Hyprland isn't reachable right now (hooks just won't function until
-  # the user logs into Hyprland on the host).
+  # even if the compositor isn't reachable right now (hooks just won't
+  # function until it is).
   [[ "${STREAM_MODE:-}" == "headless" ]] || return 0
 
-  if command -v hyprctl >/dev/null 2>&1; then
-    ok "hyprctl on PATH"
-  else
-    warn "hyprctl not found. Headless prep-cmd hooks will fail until Hyprland is installed and reachable."
-  fi
+  case "${COMPOSITOR:-none}" in
+    hyprland)
+      ok "hyprctl on PATH"
+      if [[ -n "${HYPRLAND_INSTANCE_SIGNATURE:-}" ]]; then
+        ok "Hyprland instance signature present in environment"
+      else
+        local rt="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+        if compgen -G "$rt/hypr/*/" >/dev/null 2>&1; then
+          ok "Hyprland runtime directory found under $rt/hypr/"
+        else
+          warn "Hyprland not currently running. Install will proceed; hooks engage on next Hyprland login."
+        fi
+      fi
+      ;;
+    sway)
+      ok "swaymsg/sway on PATH"
+      local rt="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+      if compgen -G "$rt/sway-ipc.*.sock" >/dev/null 2>&1; then
+        ok "Sway IPC socket present under $rt"
+      else
+        info "Sway not running yet — install will start sway-headless.service before sunshine."
+      fi
+      ;;
+    none|*)
+      warn "No wlroots compositor detected. Install will attempt to install one (Sway on Debian/Ubuntu)."
+      ;;
+  esac
 
   if pkg_installed jq; then
     ok "jq installed (prep-cmd hooks have their parser)"
   else
     info "jq not installed yet — will be installed in the packages step."
   fi
-
-  if [[ -n "${HYPRLAND_INSTANCE_SIGNATURE:-}" ]]; then
-    ok "Hyprland instance signature present in environment"
-  else
-    local rt="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
-    if compgen -G "$rt/hypr/*/" >/dev/null 2>&1; then
-      ok "Hyprland runtime directory found under $rt/hypr/"
-    else
-      warn "Hyprland does not appear to be running. Install will proceed; hooks will only work once you log into Hyprland on the host."
-    fi
-  fi
 }