Add Debian/Ubuntu support via a thin distro dispatch layer

Adds a parallel install path for Debian/Ubuntu hosts alongside the existing
Arch/Omarchy/Hyprland one. The Arch path is untouched at runtime; everything
new is gated on $DISTRO and (for headless) $COMPOSITOR.

Highlights:
- lib/distro.sh: detect_distro + pkg_install/pkg_remove/ca_anchor_path/
  ca_update_trust dispatch helpers
- lib/packages.sh: Ubuntu sunshine install pulls LizardByte's official .deb
  from GitHub releases (override via SUNSHINE_DEB_URL/SUNSHINE_DEB_VERSION);
  GPU encoder packages branch per $DISTRO:$GPU_VENDOR
- bin/sunshine-stream-{do,undo,prestart}-sway.sh + files/sway-headless.*:
  swaymsg-based headless capture path for hosts without Hyprland. sway runs
  under a systemd-user unit that sunshine.service depends on via drop-in.
- lib/preflight.sh: clearer NVIDIA driver guidance on Ubuntu (we don't install
  the driver - too many branch/kernel/Secure-Boot variants); sway-aware
  headless preflight
- lib/certs.sh + lib/verify.sh + uninstall.sh: distro-aware CA trust anchor
  (Arch: /etc/ca-certificates/trust-source/anchors + update-ca-trust;
   Debian: /usr/local/share/ca-certificates + update-ca-certificates)

Verified on Ubuntu 24.04: ./install.sh --doctor --headless loads cleanly,
distro/GPU/compositor detection report the right values, all pre-install
failures correspond to the actual missing pieces.

uninstall.sh

@@ -6,6 +6,10 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib/common.sh
 source "$SCRIPT_DIR/lib/common.sh"
+# shellcheck source=lib/distro.sh
+source "$SCRIPT_DIR/lib/distro.sh"
+
+detect_distro
 
 PURGE=0
 KEEP_MOONLIGHT=0
@@ -21,7 +25,7 @@ Usage: $(basename "$0") [--purge] [--keep-moonlight] [--remove-ca-trust]
 
   --purge             Also delete ~/.config/sunshine and ~/.local/share/sunshine
   --keep-moonlight    Do not uninstall moonlight-qt
-  --remove-ca-trust   Remove the omarchy-stream CA from /etc/ca-certificates
+  --remove-ca-trust   Remove the omarchy-stream CA from the system trust store
                       (default: leave it — other hosts/services may rely on it)
 EOF
       exit 0 ;;
@@ -32,8 +36,9 @@ done
 
 require_not_root
 
-step "Stopping Sunshine service"
+step "Stopping services"
 systemctl --user disable --now sunshine.service 2>/dev/null || true
+systemctl --user disable --now sway-headless.service 2>/dev/null || true
 
 step "Removing user lingering (if enabled by us)"
 if loginctl show-user "$USER" -p Linger --value 2>/dev/null | grep -qx yes; then
@@ -42,19 +47,37 @@ if loginctl show-user "$USER" -p Linger --value 2>/dev/null | grep -qx yes; then
 fi
 
 step "Removing packages"
-# Remove -debug siblings first so they don't collide with re-installation later.
-for pkg in sunshine-debug sunshine-bin-debug sunshine sunshine-bin; do
-  if pacman -Qi "$pkg" >/dev/null 2>&1; then
-    as_root pacman -Rns --noconfirm "$pkg"
-  fi
-done
-if [[ $KEEP_MOONLIGHT -eq 0 ]]; then
-  for pkg in moonlight-qt moonlight-qt-bin; do
-    if pacman -Qi "$pkg" >/dev/null 2>&1; then
-      as_root pacman -Rns --noconfirm "$pkg"
+case "$DISTRO" in
+  arch)
+    # Remove -debug siblings first so they don't collide with re-installation later.
+    pkg_remove sunshine-debug sunshine-bin-debug sunshine sunshine-bin
+    if [[ $KEEP_MOONLIGHT -eq 0 ]]; then
+      pkg_remove moonlight-qt moonlight-qt-bin
     fi
-  done
-fi
+    ;;
+  debian)
+    pkg_remove sunshine
+    if [[ $KEEP_MOONLIGHT -eq 0 ]]; then
+      pkg_remove moonlight-qt
+    fi
+    ;;
+  *)
+    warn "Unknown distro; skipping package removal."
+    ;;
+esac
+
+step "Removing user-installed systemd units + drop-ins"
+rm -f \
+  "$HOME/.config/systemd/user/sway-headless.service" \
+  "$HOME/.config/systemd/user/sunshine.service.d/sway-headless.conf" \
+  "$HOME/.config/systemd/user/sunshine.service.d/headless-prestart.conf" \
+  "$HOME/.config/systemd/user/app-dev.lizardbyte.app.Sunshine.service.d/headless-prestart.conf"
+# Clean empty .d directories
+rmdir --ignore-fail-on-non-empty \
+  "$HOME/.config/systemd/user/sunshine.service.d" \
+  "$HOME/.config/systemd/user/app-dev.lizardbyte.app.Sunshine.service.d" \
+  2>/dev/null || true
+systemctl --user daemon-reload 2>/dev/null || true
 
 step "Removing udev rule (if we wrote one)"
 if [[ -f /etc/udev/rules.d/60-uinput.rules ]]; then
@@ -64,10 +87,10 @@ fi
 
 if [[ $REMOVE_CA_TRUST -eq 1 ]]; then
   step "Removing omarchy-stream CA from system trust store"
-  anchor="/etc/ca-certificates/trust-source/anchors/omarchy-stream-ca.pem"
-  if [[ -f "$anchor" ]]; then
+  anchor="$(ca_anchor_path)"
+  if [[ -n "$anchor" && -f "$anchor" ]]; then
     as_root rm -f "$anchor"
-    as_root update-ca-trust extract >/dev/null
+    ca_update_trust
     ok "Removed $anchor and refreshed trust store"
   else
     info "CA anchor not present; nothing to remove"
@@ -75,11 +98,12 @@ if [[ $REMOVE_CA_TRUST -eq 1 ]]; then
 fi
 
 if [[ $PURGE -eq 1 ]]; then
-  step "Purging Sunshine user data"
-  rm -rf "$HOME/.config/sunshine" "$HOME/.local/share/sunshine"
+  step "Purging Sunshine + sway-headless user data"
+  rm -rf "$HOME/.config/sunshine" "$HOME/.local/share/sunshine" "$HOME/.local/share/omarchy-moonlight"
+  rm -f "$HOME/.config/sway/config-headless"
 fi
 
 ok "Uninstall complete. Firewall rules and 'input' group membership were left in place."
 if [[ $REMOVE_CA_TRUST -eq 0 ]]; then
-  info "The omarchy-stream CA was left in /etc/ca-certificates (--remove-ca-trust to drop it)."
+  info "The omarchy-stream CA was left in the system trust store (--remove-ca-trust to drop it)."
 fi