Stabilize Linux AppImage Nix inputs

[AnthonyRonning]

Summary

• prove the AppImage hash failure is input drift, not the Windows Tauri PR, with README-only probe PR Probe AppImage input drift #560
• vendor the known-good Linux AppImage plugin and type2 runtime bytes and keep the existing flake hashes as fixed-output verification
• move AppImage packaging variables into a Linux desktop-specific dev shell so generic CI no longer realizes desktop packaging tools
• pin linuxdeploy GTK/GStreamer helper scripts to commit-specific raw URLs

Verification

• Probe AppImage input drift #560 reproduces the same linuxdeploy-plugin-appimage fixed-output mismatch from a README-only master-based change
• nix develop .#ci -c bash -lc 'test -z "${MAPLE_NIX_TAURI_LINUXDEPLOY_TOOLS:-}"'
• nix develop .#desktop-linux -c bash -lc 'test -n "${MAPLE_NIX_TAURI_LINUXDEPLOY_TOOLS:-}" && test -n "${MAPLE_NIX_TAURI_LINUXDEPLOY_ARCH:-}"'
• nix flake check
• nix eval .#devShells.x86_64-linux.ci.drvPath
• nix eval .#devShells.x86_64-linux.desktop-linux.drvPath
• direct nix hash file --sri checks for all four vendored binaries match flake.nix

Summary by CodeRabbit

• Chores
  • Improved Linux build system organization and toolchain configuration for CI and release pipelines.
  • Vendored AppImage build artifacts to ensure reproducible and stable builds.
  • Updated internal build environment structure for better separation of concerns.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR restructures the Linux desktop CI build environment by creating a dedicated Nix shell for AppImage tooling, vendoring build artifacts for reproducibility, and updating workflows to use the new infrastructure instead of the general CI shell.

Changes

Linux Desktop CI Shell Infrastructure

Layer / File(s)	Summary
Desktop shell and hooks flake.nix	Moves Tauri linuxdeploy environment exports into a new linuxDesktopShellHook, introduces devShells.desktop-linux (Linux-only) with CI packages plus linuxdeploy tooling, and updates the default devShell to include the desktop hook.
AppImage tooling vendoring and documentation flake.nix, nix/vendor/README.md	Reworks tauriLinuxdeployTools to build linuxdeploy-plugin-appimage and appimage-type2-runtime from local vendored sources with fixed-output hashes instead of downloading mutable upstream artifacts, and pins plugin scripts to specific commit SHAs. Adds README documenting the vendored binaries and hash verification.
CI app shell selection logic flake.nix	Adds desktopCiShell variable selecting desktop-linux on Linux and ci otherwise, then updates three desktop CI apps (ci-desktop-pr, ci-desktop-release, ci-signed-desktop-release-rehearsal) to use this selector.
Workflow updates to use desktop-linux shell .github/workflows/desktop-build.yml, .github/workflows/desktop-pr-build.yml, .github/workflows/release.yml	Updates Linux build, sccache stats, and checksum steps across three workflows to invoke nix develop .#desktop-linux instead of .#ci.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• OpenSecretCloud/Maple#552: Related workflow enforcement script that validates parity across desktop and release build targets affected by shell target changes.
• OpenSecretCloud/Maple#544: Related to linuxdeploy plugin and runtime packaging modifications for reproducible AppImage builds in flake.nix.
• OpenSecretCloud/Maple#541: Related AppImage linuxdeploy toolchain changes that work with the vendored and pinned artifacts introduced here.

Poem

🐰 A desktop shell takes shape with care,
Vendored artifacts, hashes fair.
Workflows align in CI's dance,
Linux builds get their grand stance!
AppImages now reproducibly planned. ✨

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately describes the main change: stabilizing Linux AppImage Nix inputs by vendoring binaries and pinning dependencies, which is the core objective across all modified files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/immutable-linuxdeploy-inputs

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying maple with Cloudflare Pages

Latest commit:	47c86e8
Status:	✅ Deploy successful!
Preview URL:	https://ea7bbe4f.maple-ca8.pages.dev
Branch Preview URL:	https://fix-immutable-linuxdeploy-in.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional findings.