Release KDE and Firefox profile support

[ob1-s]

What changed

• adds production CachyOS/Arch packaging and KDE Plasma/Wayland activity collection
• fixes KDE application identity/icon integration in the packaged app
• adds Firefox native messaging and separate development/release identities
• adds local, user-labeled Chrome/Firefox profile connections with independent signal settings
• preserves browser provenance while deduplicating overlapping shared-device duration
• adds safe backup tooling and KWallet-compatible key encoding
• bumps the release checkpoint to 0.1.6
• adds reproducible Arch and Firefox release/reviewer workflows

Why

The previous CachyOS setup launched the development toolchain instead of an installed release and treated browser collection as a single Chrome connection. Firefox dogfooding, KDE activity collection, and multiple browser profiles therefore did not have a durable packaged path.

Privacy and user impact

Browser profiles use a random local source ID, coarse browser family, and user-owned label. MindCanary does not read or store browser account names, email addresses, profile paths, URLs, page titles, page text, search terms, or browsing history.

Firefox release collection uses Mozilla's optional built-in data consent. General aggregates require technicalAndInteraction; the optional feed adapter separately requires websiteActivity and its narrow host permissions.

Validation

• pnpm check
• nested Tauri cargo check
• Firefox release build reproducibility: identical XPI SHA-256 across two builds
• Mozilla web-ext 10.5.0 validation: 0 errors, 0 warnings, 0 notices
• Arch source and final package reproducibility: byte-identical across two clean builds
• package metadata and installed file list inspected
• live KDE/Wayland daemon and Firefox native-host/profile registration verified on CachyOS