Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

lib/service.sh

@@ -1,11 +1,15 @@
 #!/usr/bin/env bash
 # Enable Sunshine as a systemd --user service and turn on lingering so it
-# runs at boot without a graphical login.
+# runs at boot without a graphical login. On Ubuntu installs that use the
+# Sway-headless capture path, also installs + enables sway-headless.service
+# and wires sunshine.service to depend on it.
 
 ensure_sunshine_unit_present() {
   # Case 1: a sunshine.service unit already exists in any path systemd-user
-  # scans. sunshine-bin ships /usr/lib/systemd/user/sunshine.service directly.
+  # scans. The LizardByte .deb on Ubuntu drops it at /lib/systemd/user/.
+  # sunshine-bin on Arch drops it at /usr/lib/systemd/user/.
   for p in \
+    /lib/systemd/user/sunshine.service \
     /usr/lib/systemd/user/sunshine.service \
     /etc/systemd/user/sunshine.service \
     "$HOME/.config/systemd/user/sunshine.service" \
@@ -20,6 +24,7 @@ ensure_sunshine_unit_present() {
   local fqdn_unit=""
   for p in \
     /usr/lib/systemd/user/app-dev.lizardbyte.app.Sunshine.service \
+    /lib/systemd/user/app-dev.lizardbyte.app.Sunshine.service \
     /etc/systemd/user/app-dev.lizardbyte.app.Sunshine.service
   do
     [[ -f "$p" ]] && { fqdn_unit="$p"; break; }
@@ -44,13 +49,64 @@ ensure_sunshine_unit_present() {
   ok "Installed $HOME/.config/systemd/user/sunshine.service"
 }
 
+# Install and enable the headless sway compositor unit + config (Debian/Ubuntu
+# headless path only). sunshine.service gets a drop-in making it depend on
+# sway-headless.service so the wlr capture has something to talk to.
+ensure_sway_headless_unit() {
+  [[ "$DISTRO" == "debian" ]] || return 0
+  [[ "${STREAM_MODE:-}" == "headless" ]] || return 0
+  [[ "${COMPOSITOR:-}" == "sway" ]] || return 0
+
+  local cfg_src="$SCRIPT_DIR/files/sway-headless.config"
+  local svc_src="$SCRIPT_DIR/files/sway-headless.service"
+  if [[ ! -f "$cfg_src" || ! -f "$svc_src" ]]; then
+    err "Missing sway-headless source files in $SCRIPT_DIR/files/"
+    return 1
+  fi
+
+  mkdir -p "$HOME/.config/sway" "$HOME/.config/systemd/user"
+  install -m 0644 "$cfg_src" "$HOME/.config/sway/config-headless"
+  install -m 0644 "$svc_src" "$HOME/.config/systemd/user/sway-headless.service"
+
+  # Wire sunshine.service to wait for sway-headless.service. Done via a
+  # drop-in so we don't overwrite the upstream unit shipped by the .deb.
+  local sun_dropin_dir="$HOME/.config/systemd/user/sunshine.service.d"
+  mkdir -p "$sun_dropin_dir"
+  cat >"$sun_dropin_dir/sway-headless.conf" <<'EOF'
+# Installed by omarchy-moonlight. Sunshine's wlr capture needs a running
+# wlroots compositor; sway-headless provides one on headless servers.
+[Unit]
+After=sway-headless.service
+Requires=sway-headless.service
+
+[Service]
+# Inherit the sway IPC socket location so hooks can talk to swaymsg.
+Environment=XDG_SESSION_TYPE=wayland
+Environment=WAYLAND_DISPLAY=wayland-1
+EOF
+
+  systemctl --user daemon-reload
+  systemctl --user enable sway-headless.service >/dev/null
+  if ! systemctl --user is-active --quiet sway-headless.service; then
+    info "Starting sway-headless.service"
+    systemctl --user restart sway-headless.service || {
+      err "sway-headless.service failed to start. Inspect: journalctl --user -u sway-headless"
+      return 1
+    }
+    # Give sway a beat to create its IPC socket.
+    sleep 1
+  fi
+  ok "sway-headless.service active"
+}
+
 enable_sunshine_service() {
-  # The AUR 'sunshine' (source) package doesn't always ship a systemd user unit
-  # at the standard /usr/lib/systemd/user/sunshine.service path. If systemd
-  # can't find one, drop our own copy into ~/.config/systemd/user/.
   ensure_sunshine_unit_present
   systemctl --user daemon-reload
 
+  # If we're on the Debian+Sway headless path, install the sway-headless unit
+  # before sunshine so the dependency chain is satisfied when we start it.
+  ensure_sway_headless_unit
+
   # In headless mode, install a drop-in that pre-creates HEADLESS-1 before
   # Sunshine starts. Done here because the drop-in target name depends on
   # which unit ensure_sunshine_unit_present resolved.
@@ -59,7 +115,7 @@ enable_sunshine_service() {
   fi
 
   if ! systemctl --user list-unit-files sunshine.service >/dev/null 2>&1; then
-    err "sunshine.service still not found after fallback. Inspect: find /usr ~/.config -name sunshine.service"
+    err "sunshine.service still not found after fallback. Inspect: find /usr /lib ~/.config -name sunshine.service"
     return 1
   fi
 
@@ -78,7 +134,6 @@ enable_sunshine_service() {
   systemctl --user reset-failed sunshine.service 2>/dev/null || true
 
   info "Starting sunshine.service (user)"
-  # Restart so a re-run picks up new config / new caps. Tolerate first-launch races.
   systemctl --user restart sunshine.service || systemctl --user start sunshine.service || {
     err "Failed to start sunshine.service. Check: journalctl --user -u sunshine"
     return 1