fix(release): address code review findings (P1-P3)

P1 fixes (must-fix):
- AppRun: VLC path corrected to usr/lib/app/linux/vlc (jpackage actual
  path), add VLC_PLUGIN_PATH env var for codec discovery
- linuxdeploy: use APPIMAGE_EXTRACT_AND_RUN=1 env var to bypass FUSE
  on CI runners instead of fragile pre-extract + symlink approach
- Prerelease classifier: inverted to positive-match stable format
  (^v[0-9]+\.[0-9]+\.[0-9]+$) across desktop, Android, and composite
  action — eliminates regex drift between allowlists
- assert-stable-release: now accepts inputs (tag, is_prerelease,
  is_draft) so workflow_dispatch on bump workflows also validates

P2 fixes (should-fix):
- .gitignore: add linuxdeploy-*.AppImage and extracted dirs
- RPM version: use replace("-", "~") instead of substringBefore("-")
  for correct RPM prerelease ordering (1.08.0~rc1 < 1.08.0)
- linux-portable → linux alias moved into collect_assets() in
  scripts/asset-name.sh (single source of truth)
- Android cache key: add gradle/libs.versions.toml to hashFiles
- r0adkll/sign-android-release: SHA-pinned to 349ebdef (v1)

P3 fixes (nice-to-have):
- LINUXDEPLOY_OUTPUT_VERSION env var replaced with
  APPIMAGE_EXTRACT_AND_RUN (misleading comment + redundant var)
- nick-fields/retry timeout: 40m → 15m (surface real hangs)
- generate_release_notes: true only on Android job (avoid
  last-writer-wins race across 6 concurrent uploaders)
- apt-get install rpm: tightened guard to matrix.family == 'linux'
  (linux-portable leg doesn't need rpm tooling)

desktopApp/build.gradle.kts

@@ -9,10 +9,9 @@ plugins {
     id("ir.mahozad.vlc-setup") version "0.1.0"
 }
 
-// RPM rejects dashes in version strings — strip prerelease suffix for Linux RPM only.
-// Other formats accept full semver (DEB uses ~rc1, DMG/MSI accept bare versions).
+// RPM rejects dashes in version strings — replace with tilde (~) which RPM uses
+// for prerelease ordering: 1.08.0~rc1 < 1.08.0 per RPM version comparison rules.
 val appVersion: String = project.version.toString()
-val appVersionRpm: String = appVersion.substringBefore("-")
 
 sourceSets {
     main {
@@ -120,8 +119,8 @@ compose.desktop {
                 appCategory = "Network"
                 debMaintainer = "vitor@vitorpamplona.com"
                 rpmLicenseType = "MIT"
-                // RPM version field rejects dashes; strip prerelease suffix for RPM builds.
-                rpmPackageVersion = appVersionRpm
+                // RPM version: replace dashes with tilde (1.08.0~rc1 < 1.08.0 per RPM ordering).
+                rpmPackageVersion = appVersion.replace("-", "~")
             }
         }
     }
@@ -201,6 +200,7 @@ val createReleaseAppImage by tasks.registering(Exec::class) {
     )
     environment("OUTPUT", outFile.get().asFile.absolutePath)
     environment("ARCH", "x86_64")
-    // Suppress linuxdeploy's verbose library-scanner output; keep errors.
-    environment("LINUXDEPLOY_OUTPUT_VERSION", appVersion)
+    // Bypass FUSE requirement on CI runners (ubuntu-latest lacks libfuse.so.2).
+    // AppImage standard env var: extracts + runs without mounting.
+    environment("APPIMAGE_EXTRACT_AND_RUN", "1")
 }