Compile the Linux shell, and keep compiling it

[thcp]

Closes #550
Closes #531

cargo check has been failing on Linux on main. Found by building the shell in WSL against the real cfg gates.

The break

error[E0425]: cannot find function `verify_pinned_sha256` in this scope
    --> src/main.rs:3838:9
note: found an item that was configured out
    --> src/main.rs:3914:4
     | #[cfg(target_os = "macos")]

download_linux_ffmpeg verifies its download against a pinned SHA256, which is the whole point of #518. The function it calls was macOS-gated, so on Linux the call referred to something that did not exist.

The Linux release build would have failed after the tag existed, and after the macOS and Windows jobs may already have uploaded their assets, because linux-release.yml is the only thing that compiles this code.

The gate belongs on unix. Both callers are Unix, Windows takes a different path, and widening further would only add a dead-code warning there.

The tests were dark too

The three verify_pinned_sha256 tests were #[cfg(target_os = "macos")] as well, so Linux depended on a function it had never once tested. They move with it.

The Linux suite goes from 57 to 63. Three of those six are these.

Keeping it compiled

Fixing the gate alone leaves the hole open, which is #531. Whatever lands next inside a Linux cfg block has the same nothing waiting to catch it.

linux-check.yml mirrors the other two check workflows with one deliberate difference: it runs on every PR that touches desktop/src-tauri, not on manual dispatch. macos-check.yml and windows-check.yml are manual because they occupy the self-hosted machine that builds releases. This one is GitHub-hosted and disposable, so there is no cost argument, and no reason for the fork guard the other two carry either.

It installs the same GTK and WebKit packages scripts/linux/make-portable.sh needs, then runs cargo fmt --check, cargo build --tests, cargo clippy --tests -- -D warnings and cargo test.

ci.yml running entirely on ubuntu-latest is what made Linux look covered. It never invokes cargo.

Verification

Ubuntu 24.04, WSL:

cargo fmt --check                        clean
cargo clippy --all-targets -- -D warnings  clean
cargo test                               63 passed

Windows, unchanged by the gate move:

cargo clippy --all-targets  clean
cargo test                  57 passed

No clippy allowances were needed on Linux. Unlike the Windows check's first run, this target came up clean.

Note on 0.16.1

This is not in the 0.16.1 merge that just landed on main. Tagging before this lands means the Linux release build fails.