feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 22 insertions, 0 deletions

diff --git a/packaging/deb/meshbay-client/DEBIAN/postinst b/packaging/deb/meshbay-client/DEBIAN/postinst
new file mode 100644
index 0000000..f262665
--- /dev/null
+++ b/packaging/deb/meshbay-client/DEBIAN/postinst
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # chrome-sandbox requires SUID root for Chromium's namespace sandbox
+        if [ -f /opt/meshbay-client/chrome-sandbox ]; then
+            chown root:root /opt/meshbay-client/chrome-sandbox
+            chmod 4755 /opt/meshbay-client/chrome-sandbox
+        fi
+
+        # Update desktop database and icon cache
+        if command -v update-desktop-database >/dev/null 2>&1; then
+            update-desktop-database /usr/share/applications || true
+        fi
+        if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+            gtk-update-icon-cache -f -t /usr/share/icons/hicolor || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#