ci(packaging): punktfunk-client .deb + RPM subpackage

Hook the Linux client into the existing packaging CI:

- deb.yml builds both binaries and publishes punktfunk-host AND
  punktfunk-client to the Gitea apt registry; new
  packaging/debian/build-client-deb.sh mirrors the host script
  (shlibdeps auto-Depends — GTK4/libadwaita/SDL3/FFmpeg/PipeWire
  sonames; no NVIDIA filter, the client links no CUDA). Built and
  inspected locally on Ubuntu 26.04.
- punktfunk.spec gains a "client" subpackage (binary + desktop entry +
  udev rule); rpm.yml's publish loop picks it up unchanged.
- New shared assets: packaging/linux/io.unom.Punktfunk.desktop and
  scripts/70-punktfunk-client.rules — DualSense hidraw uaccess (USB +
  Bluetooth, steam-devices style) so SDL's HIDAPI driver gets
  touchpad/motion/lightbar/triggers instead of degrading to evdev.
- Builder images learn the client link deps (rust-ci already had
  them; fedora-rpm adds gtk4/libadwaita/SDL3-devel) with idempotent
  install steps in deb.yml/rpm.yml since jobs run against the
  previous push's image.

Workspace check CI (build/clippy/test) already covers the crate since
f09def4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deb.yml

@@ -1,7 +1,8 @@
-# Build the punktfunk-host .deb and publish it to Gitea's Debian package registry, so the
-# Ubuntu hosts get new builds via `apt update && apt upgrade`. Runs inside the same Ubuntu
-# 26.04 rust-ci builder image as ci.yml, so dpkg-shlibdeps pins the runtime lib package names
-# (libavcodec62, libpipewire-0.3-0t64, …) to exactly what the target boxes run.
+# Build the punktfunk-host and punktfunk-client .debs and publish them to Gitea's Debian
+# package registry, so Ubuntu boxes get new builds via `apt update && apt upgrade`. Runs
+# inside the same Ubuntu 26.04 rust-ci builder image as ci.yml, so dpkg-shlibdeps pins the
+# runtime lib package names (libavcodec62, libpipewire-0.3-0t64, …) to exactly what the
+# target boxes run.
 #
 # Registry (public, unom org): https://git.unom.io/unom/-/packages
 # Box setup (once):  see packaging/debian/README.md
@@ -30,9 +31,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # dpkg-shlibdeps (Depends resolution) + dpkg-deb live in dpkg-dev.
-      - name: dpkg-dev
-        run: apt-get update && apt-get install -y --no-install-recommends dpkg-dev
+      # dpkg-shlibdeps (Depends resolution) + dpkg-deb live in dpkg-dev. The client's link
+      # deps are also baked into the rust-ci image, but this job runs against the image
+      # from the PREVIOUS push (docker.yml bootstrap note) — keep it green across image
+      # changes; a no-op once the image has them.
+      - name: dpkg-dev + client link deps
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends dpkg-dev \
+            libgtk-4-dev libadwaita-1-dev libsdl3-dev
 
       # Share ci.yml's cache keys so the release build reuses its registry + target artifacts.
       - name: Cache keys
@@ -50,10 +57,10 @@ jobs:
           key: cargo-target-${{ env.rustc }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-target-${{ env.rustc }}-
 
-      - name: Build release host
+      - name: Build release host + client
         run: |
           git config --global --add safe.directory "$PWD"
-          cargo build --release -p punktfunk-host --locked
+          cargo build --release -p punktfunk-host -p punktfunk-client-linux --locked
 
       - name: Version
         # Tag v1.2.3 -> 1.2.3 (a real release); a main push -> 0.0.1~ciN.g<sha>, which sorts
@@ -68,16 +75,19 @@ jobs:
           echo "VERSION=$V" >> "$GITHUB_ENV"
           echo "package version $V"
 
-      - name: Build .deb
-        run: VERSION="$VERSION" bash packaging/debian/build-deb.sh
+      - name: Build .debs
+        run: |
+          VERSION="$VERSION" bash packaging/debian/build-deb.sh
+          VERSION="$VERSION" bash packaging/debian/build-client-deb.sh
 
       - name: Publish to the Gitea apt registry
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          DEB="$(ls dist/*.deb)"
-          echo "uploading $DEB"
-          # PAT owner (enricobuehler), not the push actor — matches docker.yml's registry login.
-          curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
-            "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
-          echo "published $DEB to $OWNER/debian $DISTRIBUTION/$COMPONENT"
+          for DEB in dist/*.deb; do
+            echo "uploading $DEB"
+            # PAT owner (enricobuehler), not the push actor — matches docker.yml's registry login.
+            curl -fsS --user "enricobuehler:$TOKEN" --upload-file "$DEB" \
+              "https://$REGISTRY/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
+          done
+          echo "published to $OWNER/debian $DISTRIBUTION/$COMPONENT"

.gitea/workflows/rpm.yml

@@ -33,8 +33,13 @@ jobs:
       - uses: actions/checkout@v4
 
       # rpmbuild + git archive need the checkout trusted; cache the crates download.
+      # The client link deps are also baked into the fedora-rpm image, but this job runs
+      # against the image from the PREVIOUS push (docker.yml bootstrap note) — keep it
+      # green across image changes; a no-op once the image has them.
       - name: Prep
-        run: git config --global --add safe.directory "$PWD"
+        run: |
+          git config --global --add safe.directory "$PWD"
+          dnf -y install gtk4-devel libadwaita-devel SDL3-devel
       - uses: actions/cache@v4
         with:
           path: /usr/local/cargo/registry