Debian support: verified build/packaging path + friend install guide

- setup-standalone.sh: falls back to system python3 -m venv + pip when
  uv isn't installed (Debian/Ubuntu path; verified on clean bookworm).
- dist/Dockerfile.debian: debian:bookworm build env for :app:packageDeb
  (needs fakeroot + /usr/share/desktop-directories — both baked in; the
  dir gap made jpackage's postinst fail with exit 3 on minimal systems).
- dist/make-release.sh: clean source tarball from HEAD.
- INSTALL-debian.md: end-to-end install for friends (source tree must
  stay on disk — the app spawns the engine from it via SHONAR_REPO).

Verified on real Debian 12 in Docker: :app:packageDeb builds
shonar-desktop_0.1.0-1_amd64.deb, apt installs it, setup-standalone.sh
provisions the engine (venv+pip path, model fetch, boot smoke test),
and the packaged binary launches under Xvfb.

dist/make-release.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Build a shonar-desktop source release tarball from HEAD (no secrets, no
+# build junk, no runtime data). Friends unpack it and run setup-standalone.sh.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+VER=$(git describe --tags --always 2>/dev/null || echo dev)
+OUT="dist/shonar-desktop-$VER.tar.gz"
+git archive --format=tar --prefix="shonar-desktop/" HEAD \
+  | gzip > "$OUT"
+echo "wrote $OUT ($(du -h "$OUT" | cut -f1))"