ci(release): stop bundling libwayland in the AppImage and reuse build.yml for releases

[debba]

Fixes #423.

Root cause

The AppImage bundles the build container's libwayland-client/cursor/egl/server (Ubuntu 22.04, libwayland ~1.20). On distros with a recent Mesa (Solus, up to date Arch) the host libEGL binds to that stale bundled libwayland-client instead of the system one, protocol marshalling doesn't match, and WebKitWebProcess aborts with EGL_BAD_PARAMETER, leaving a black window. This is a known class of AppImage breakage: the upstream excludelist added libwayland-client.so.0 for exactly this reason (AppImageCommunity/pkg2appimage#559, referencing mesa#11316). The linuxdeploy binary pinned by tauri-cli predates that entry, and upstream has stated the linuxdeploy based bundler won't be worked on anymore (tauri-apps/tauri#8604), so waiting for a fix there is not an option.

The regression window matches the CI history: v0.13.2 was built with the custom feat/truly-portable-appimage tauri-cli and worked, then fe592726 switched releases back to the official tauri-cli 2.11.4 and v0.13.3/v0.13.4 broke. Nightlies kept the custom CLI in build.yml, which is why they still work on Solus today. HelixNotes, mentioned in the issue as a working reference, actually ships the same four libwayland libs; theirs happen to be new enough (glibc 2.38 base) to still be compatible with current Mesa, so it is the same time bomb on a longer fuse rather than a different approach.

What changed

.github/workflows/build.yml: the stable path (official tauri-cli) now pre-seeds a patched linuxdeploy-plugin-gtk.sh into the tauri tools cache. tauri-bundler only downloads that file when it is missing, so the patched copy is picked up and removes libwayland-*.so* from the AppDir at the end of the plugin run, before the squashfs is packed. The updater signature is computed afterwards and stays valid. The custom CLI override, TAURI_BUNDLER_NEW_APPIMAGE_FORMAT and the cargo tauri script are now gated behind a new experimental_appimage input (default false). Also added a release_body input so callers can set the release notes.

.github/workflows/release.yml: rewritten as a thin dispatcher: a meta job resolving ref/tag/prerelease (same logic as before, tag push or pr_number/tag_name dispatch) plus a workflow_call to build.yml. The duplicated matrix, signing and notarization config is gone, which is what allowed the two channels to drift apart and cause this regression in the first place. As a side effect releases inherit the correct Rust target condition for macos-15-intel (the old copy still referenced macos-13).

.github/workflows/nightly.yml: passes experimental_appimage: true, so nightlies keep building the sharun based format from tauri-apps/tauri#12491 unchanged and keep serving as its daily canary until that PR stabilises.

Verification

• Local build with the patched plugin pre-seeded in an isolated XDG_CACHE_HOME: the produced AppImage contains 0 libwayland-* files (the published v0.18.0 contains 4), the rest of the bundle is unchanged, and the app starts cleanly with host libwayland (GTK/WebKit up, no EGL errors).
• Workflow YAML parsed and expressions checked; the heredoc in the patch step dedents correctly.
• CI-fidelity check: a prerelease will be dispatched from this PR (pr_number + v0.18.1-appimage-test.1) so the Solus reporters in [Bug]: AppImage Fails to Start #423 can test the artifact built in the ubuntu:22.04 container before this merges.

CI YAML only, no code symbols touched (GitNexus impact analysis n/a).