Add Fedora and Arch package recipes (#24)

* Package Ferese for Fedora and Arch releases

* Build release packages alongside workspace checks

* Include dependency licenses and software GPU test drivers

* Limit package checks to release PRs and fix Arch Cargo dependency

* Prepare Ferese 0.1.0-beta

* Release config locks before closing inherited file descriptions

* Install the lock PAM policy for native release checks

* Include xauth in distribution package test dependencies

* Regenerate Arch Git package metadata

* Run package checks with an explicit UTC timezone

* Remove unused bundled fonts and accept installed license receipts

* Format the system font test helper

* Load an installed font for headless text rendering checks

* Isolate package test runtimes and reap container child processes

.github/workflows/release-checks.yml

@@ -3,12 +3,12 @@ on:
   pull_request:
   push:
     branches: [main]
-    tags: ["v*"]
   workflow_dispatch:
+  workflow_call:
 permissions:
   contents: read
 concurrency:
-  group: release-checks-${{ github.ref }}
+  group: release-checks-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 jobs:
   workspace:
@@ -69,7 +69,9 @@ jobs:
           cargo test --locked -p ferese backends::direct::capture::tests::capture_recomposes_cursor_without_touching_the_display_target -- --ignored
           cargo test --locked -p ferese winit::tests::capture_failure_restores_display_target_and_subsequent_frames_render -- --ignored
       - name: Test native shell, visibility and resize behavior
-        run: python3 scripts/ci/run-native-checks.py --suite desktop --log-dir native-logs
+        run: |
+          install -m 0644 packaging/pam.d/ferese-lock.fedora /etc/pam.d/ferese-lock
+          python3 scripts/ci/run-native-checks.py --suite desktop --log-dir native-logs
       - name: Upload native test logs
         if: always()
         uses: actions/upload-artifact@v4
@@ -79,37 +81,3 @@ jobs:
           if-no-files-found: ignore
       - name: Test installer, session recovery and private portal contracts
         run: python3 -m unittest discover -s scripts/tests -v
-
-  publish:
-    name: Publish validated tag
-    needs: workspace
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/github-script@v8
-        with:
-          script: |
-            const tag = context.ref.slice('refs/tags/'.length);
-            const repo = context.repo;
-            const commit = await github.rest.repos.getCommit({...repo, ref: tag});
-            if (commit.data.sha !== context.sha) {
-              throw new Error('Release tag moved after validation');
-            }
-            let release;
-            try {
-              release = (await github.rest.repos.getReleaseByTag({...repo, tag})).data;
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-            if (release?.draft) {
-              await github.rest.repos.updateRelease({...repo, release_id: release.id, draft: false});
-            } else if (!release) {
-              await github.rest.repos.createRelease({
-                ...repo, tag_name: tag, name: tag,
-                generate_release_notes: true, prerelease: tag.includes('-')
-              });
-            } else {
-              core.notice(`Release ${tag} is already published`);
-            }