feat(linux): native tray app, Rust core and AppImage releases

[productdevbook]

Adds Linux support: a GTK 3 system tray app, the Rust scanning core, CI, and an AppImage attached to each release.

Supersedes #111. That PR targeted feat/rust-cross-platform-backend, which is 57 commits behind main, so nothing in it reached users. This rebuilds the work on current main and keeps only the Linux parts.

Credit to @raine1120 for the original implementation.

Scope

Deliberately not included:

• portkiller-core's macOS and Windows backends, and the windows crate dependency. Those platforms have native Swift and .NET apps that don't use this crate, so shipping their Rust implementations would be dead code. scanner/mod.rs and process/mod.rs are now Linux-only, and the crate compile_error!s elsewhere.
• portkiller-ffi.

platforms/linux/ is self-contained Python and doesn't depend on the Rust core today. Worth deciding later whether it should bind to it through FFI rather than keeping two scanner implementations.

CI — .github/workflows/ci-linux.yml

• Rust: cargo build/test/clippy -D warnings/fmt --check on Ubuntu, with procps iproute2 lsof installed — without them the integration tests fail instead of exercising the real paths. This code is cfg-gated, so the existing macOS/Windows jobs never compiled it.
• Python: parser tests on 3.9 and 3.12, plus shellcheck on install.sh.
• Smoke: imports every module under a real GTK stack via xvfb. The parser tests never load the UI modules, so a broken import there would otherwise slip through.

Release — build-linux job

Builds an AppImage and attaches it to the release.

The GTK stack is taken from the host rather than bundled. PyGObject binds tightly to the system GLib/GTK, and bundling those breaks on distros whose versions differ from the build image. The launcher checks for the bindings up front and prints per-distro install hints if they're missing. The job then extracts the AppImage it just built and asserts the entry point, src/ and AppRun are all present.

Verification

Everything below was run on Linux in Docker, not just on macOS:

• cargo build + cargo test — 20 tests + 2 doc-tests pass (with procps/iproute2/lsof present)
• cargo clippy -- -D warnings and cargo fmt --check — clean
• Python suite — 26 tests pass on 3.x
• shellcheck install.sh — clean
• AppImage — built end to end (959K) and verified by extraction

Two things the verification caught and fixed: a manual_strip clippy failure, and install.sh looking for the icon at a root Resources/ directory that only existed on the old branch.

Included from the #111 review

The review fixes are all carried over — most notably pkill -f "kubectl.*port-forward" (which matched unrelated processes) replaced with signalling only scanned PIDs, window.py wired up instead of sitting dead, scanning moved off the GTK main thread, the SIGTERM→SIGKILL sequence honoured, and the UTF-8 mangling in decode_escaped.

[productdevbook]

Merged into main as fcfdb5a. Squashed and pushed directly so the commit is authored by @raine1120, who wrote the implementation. The tree is byte-identical to this PR's head — all four CI jobs passed here before merge.