LLeMbas Desktop: the server in a window, the CLI's agent on this computer

Tauri 2, no Node. A first-run page chooses the server; then the window is
the server's web UI, whose pages get no IPC. The bundled LLeMbas CLI
(fetched and signature-checked by scripts/fetch-cli.sh) links the computer
with 'lembas login --json' and runs as 'lembas service' while the app runs.
A tray menu starts and stops it. Linux packages from GitHub Actions on a tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,64 @@
+# A release, from a signed tag vX.Y.Z on main: the Linux packages (.deb and AppImage) built with
+# the LLeMbas CLI inside, SHA256SUMS over them, and the GitHub Release with the tag message as its
+# notes. LLeMbas Desktop is developed on Gitea, which mirrors its commits and tags here; the builds
+# happen here because they need a full Rust and WebKitGTK toolchain.
+name: release
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag, e.g. v0.1.0"
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  linux:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      TAG: ${{ inputs.tag || github.ref_name }}
+      # linuxdeploy is itself an AppImage; runners have no FUSE.
+      APPIMAGE_EXTRACT_AND_RUN: "1"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+      - name: The tag object, with its message
+        run: git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
+      - name: The tag names this version
+        run: |
+          version="$(sed -n -E 's/^version = "([^"]+)"$/\1/p' src-tauri/Cargo.toml | head -n1)"
+          [ "v$version" = "$TAG" ] || { echo "Cargo.toml says $version, the tag is $TAG" >&2; exit 1; }
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+      - name: System libraries (WebKitGTK, the tray, AppImage)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev file
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: src-tauri
+      - name: The bundled LLeMbas CLI, verified
+        run: scripts/fetch-cli.sh
+      - name: Tauri's CLI
+        run: cargo install tauri-cli --version "^2" --locked
+      - name: Build
+        run: cargo tauri build --bundles deb,appimage
+      - name: Collect the files and SHA256SUMS
+        run: |
+          mkdir dist
+          cp src-tauri/target/release/bundle/deb/*.deb src-tauri/target/release/bundle/appimage/*.AppImage dist/
+          cd dist
+          { echo "# llembas-desktop $VERSION"; sha256sum -- *; } > SHA256SUMS
+          cat SHA256SUMS
+      - name: Publish the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git tag -l --format='%(contents)' "$TAG" | sed '/-----BEGIN SSH SIGNATURE-----/,$d' > notes.md
+          gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --title "LLeMbas Desktop $VERSION" --notes-file notes.md dist/*