fix(release): address code review findings (P1-P3)

P1 fixes (must-fix):
- AppRun: VLC path corrected to usr/lib/app/linux/vlc (jpackage actual
  path), add VLC_PLUGIN_PATH env var for codec discovery
- linuxdeploy: use APPIMAGE_EXTRACT_AND_RUN=1 env var to bypass FUSE
  on CI runners instead of fragile pre-extract + symlink approach
- Prerelease classifier: inverted to positive-match stable format
  (^v[0-9]+\.[0-9]+\.[0-9]+$) across desktop, Android, and composite
  action — eliminates regex drift between allowlists
- assert-stable-release: now accepts inputs (tag, is_prerelease,
  is_draft) so workflow_dispatch on bump workflows also validates

P2 fixes (should-fix):
- .gitignore: add linuxdeploy-*.AppImage and extracted dirs
- RPM version: use replace("-", "~") instead of substringBefore("-")
  for correct RPM prerelease ordering (1.08.0~rc1 < 1.08.0)
- linux-portable → linux alias moved into collect_assets() in
  scripts/asset-name.sh (single source of truth)
- Android cache key: add gradle/libs.versions.toml to hashFiles
- r0adkll/sign-android-release: SHA-pinned to 349ebdef (v1)

P3 fixes (nice-to-have):
- LINUXDEPLOY_OUTPUT_VERSION env var replaced with
  APPIMAGE_EXTRACT_AND_RUN (misleading comment + redundant var)
- nick-fields/retry timeout: 40m → 15m (surface real hangs)
- generate_release_notes: true only on Android job (avoid
  last-writer-wins race across 6 concurrent uploaders)
- apt-get install rpm: tightened guard to matrix.family == 'linux'
  (linux-portable leg doesn't need rpm tooling)

.github/actions/assert-stable-release/action.yml

@@ -2,9 +2,20 @@ name: Assert Stable Release
 description: >-
   Defense-in-depth guard for package-manager bump workflows. Re-validates
   tag format, prerelease flag, and draft status before invoking third-party
-  actions that hold write credentials to external package manager repos
-  (Homebrew, Winget, AUR, Scoop). Prevents RC builds from reaching stable
-  channels even if the `release.released` event gating is bypassed.
+  actions that hold write credentials to external package manager repos.
+
+inputs:
+  tag:
+    description: "Tag to validate (e.g. v1.08.0)"
+    required: true
+  is_prerelease:
+    description: "Whether the release is marked as prerelease (empty string treated as false)"
+    required: false
+    default: "false"
+  is_draft:
+    description: "Whether the release is a draft (empty string treated as false)"
+    required: false
+    default: "false"
 
 runs:
   using: composite
@@ -12,22 +23,16 @@ runs:
     - name: Assert release is stable
       shell: bash
       env:
-        TAG: ${{ github.event.release.tag_name }}
-        IS_PRERELEASE: ${{ github.event.release.prerelease }}
-        IS_DRAFT: ${{ github.event.release.draft }}
+        TAG: ${{ inputs.tag }}
+        IS_PRERELEASE: ${{ inputs.is_prerelease }}
+        IS_DRAFT: ${{ inputs.is_draft }}
       run: |
         set -euo pipefail
         echo "tag=$TAG prerelease=$IS_PRERELEASE draft=$IS_DRAFT"
 
-        # Reject prerelease suffix even if GitHub's flag says false.
-        if [[ "$TAG" =~ -(rc|beta|alpha|dev|snapshot) ]]; then
-          echo "::error::Tag $TAG contains prerelease suffix; refusing bump"
-          exit 1
-        fi
-
-        # Enforce strict vMAJOR.MINOR.PATCH format.
+        # Stable = exactly vMAJOR.MINOR.PATCH; reject everything else.
         if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          echo "::error::Tag $TAG does not match vMAJOR.MINOR.PATCH"
+          echo "::error::Tag $TAG does not match stable vMAJOR.MINOR.PATCH format; refusing bump"
           exit 1
         fi