test: add avatar-audit to catch #353-class dinosaur-avatar regressions

[Danathar]

Summary

Closes #353 — Bluefin's dinosaur-themed avatars never appear in the GNOME
Users account-picture picker on Dakota.

Why #353 is still open

The fix was already written and merged in #1241, but it landed on main
(the release bookmark, fast-forwarded from testing and never a valid PR
base per docs/workflow.md) instead of testing, so it never shipped in a
built image. elements/bluefin/user-avatars.bst exists on upstream/main
but not on upstream/testing.

This PR cherry-picks that exact, already-reviewed 3-file change
(c5828e0, byte-identical to #1241) onto testing, and adds a CI check so
this class of "shipped but unreachable" bug gets caught before merge instead
of silently regressing again.

Note: #1302 independently re-applies the same cherry-pick onto testing.
This PR is equivalent for that part; the addition here is the avatar-audit
Justfile recipe below. Maintainers should pick whichever PR they prefer for
the base fix — happy to close this in favor of #1302 if the audit recipe is
cherry-picked over there instead, or vice versa.

What's new: just avatar-audit

Added a swap-audit-style Justfile recipe, wired into publish.yml right
after swap-audit, that inspects the built image rather than just the
source tree:

• Bluefin avatar art actually exists under
  /usr/share/pixmaps/faces/bluefin/*.jpg.
• /etc/dconf/profile/user reads system-db:distro at all.
• The 07-dakota-avatar-directories keyfile is present.
• Every directory listed in avatar-directories exists in the image, has
  .jpg faces, and is actually present in the compiled
  /etc/dconf/db/distro (catches dconf update ordering regressions, not
  just keyfile-not-installed).

This matters because org.gnome.desktop.interface avatar-directories
replaces GNOME's default faces dirs rather than falling back to them
(cc-avatar-chooser.c in gnome-control-center, um-photo-dialog.c in
gnome-initial-setup both try configured dirs first and only fall back to
<datadir>/pixmaps/faces if that yields zero faces) — so a stale, typo'd,
or dropped override doesn't degrade to stock icons, it silently empties the
picker entirely. That failure mode is invisible from just bst artifact list-contents alone, which is exactly what let #353 go unnoticed even
though the art was correctly ingested the whole time.

Also documented this pattern in docs/skills/oci-layers.md under Lessons
Learned per the repo's self-improvement mandate — "files present in the
built image" and "files GNOME will actually discover" are different claims,
and this is the second time that gap has bitten this repo (see the FDSDK
GL-merge-symlink lesson just above it).

Testing

• just check-publish-workflow and python3 -m unittest scripts.test_check_publish_workflow pass.
• just --summary / just --dry-run avatar-audit confirm the Justfile
  parses and the recipe body is well-formed.
• The audit script's inner logic was extracted and run standalone against 7
  synthetic image-root fixtures (happy path + 6 failure modes: missing
  keyfile, stale compiled db, dangling directory reference, empty target
  directory, dconf profile not reading the distro db, empty
  avatar-directories value) — all pass/fail as expected.
• Could not run just validate / just build / just boot-test / just lint in this environment (no BuildStream/podman available, same
  constraint noted in fix: restore Bluefin dinosaur avatars in GNOME user-account picker #1241, fix(common): flatten Bluefin face icons into /usr/share/pixmaps/faces #1296, fix: restore Bluefin dinosaur avatars in GNOME user-account picker #1302); requesting CI validate + e2e
  on testing as the gate, and a maintainer build to confirm avatar-audit
  passes against the real image.

# Settings → Users → click your account picture → dinosaur avatars should
# appear in the picker (or on a fresh install, gnome-initial-setup's
# account page should offer them).
gsettings get org.gnome.desktop.interface avatar-directories
# expect: ['/usr/share/pixmaps/faces/bluefin']
ls /usr/share/pixmaps/faces/bluefin/*.jpg

• I am using an agent and I take responsibility for this PR

[github-actions]

Thanks for the PR! A maintainer will review it.

While you wait, make sure these pass locally:

just validate        # element graph check
just build default   # build the image
just boot-test       # confirm the desktop boots (exits 0 = pass)
just lint            # bootc container lint

If this PR fixes a bug, add verify steps to the linked issue so users can confirm the fix on their hardware after the next nightly ships:

```verify
ujust <something>   # what users should run to confirm the fix
```