ci: prevent incomplete Linux release archives

[lindixu6-hash]

Problem

The published v1.1.2 Linux asset reproduces Issue #50:

• locales/ and resources/ are empty in the outer archive
• the archive unexpectedly contains a nested LICENSE.zip
• the nested archive still has no resources/app, so the application exits without its packaged source

The asset has more than 2,500 downloads, so this is a release-process failure rather than an isolated local setup issue.

Change

• enable Electron Forge's ZIP maker for Linux
• add a package verifier for resources/app, the document worker, locale payloads, and unexpected nested ZIPs
• add a regression fixture matching the broken v1.1.2 archive shape
• add a least-privilege Linux package-integrity workflow with pinned Actions
• document the exact Forge ZIP output that should be uploaded instead of manually recompressing package files

This is complementary to #52: that PR fixes the runtime Worker path, while this PR ensures the Worker and the rest of resources/app are actually present in future release assets.

Verification

• npm test: 2/2 pass
• npm run verify:package -- out/chatd-linux-x64: pass on a real package
• npm run make -- --targets=@electron-forge/maker-zip --platform=linux --arch=x64: pass
• unzip -tq out/make/zip/linux/x64/chatd-linux-x64-1.0.0.zip: pass
• generated ZIP contains:
  • resources/app/package.json
  • resources/app/src/index.js
  • resources/app/src/service/worker.js
  • populated locale .pak files
  • no nested LICENSE.zip

After merge, Issue #50 still requires rebuilding and replacing the v1.1.2 Linux asset or publishing a patch release; this PR prevents recurrence rather than silently changing an existing release.

Remote fork CI independently reproduced the full Linux package path:

• run: https://github.com/lindixu6-hash/chatd/actions/runs/32056437790
• commit: 87a7e689af5c2c7948833e4d00e58a65fe0703a0
• dependency install, verifier tests, Electron Forge ZIP creation, packaged-app verification, and ZIP integrity all passed.