Linux x86_64 offline release; configurable API and bundled PostgreSQL ports.

- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12,
  PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/
  reinstall), netxctl (start/stop/status/logs, set-port, set-bind,
  set-pg-port, reconfigure-db, check-update/update/auto-update, backup,
  uninstall), systemd units, nohup fallback without systemd. Privilege
  drop, detaching and tar go through the bundled Python, so bare images
  without su/runuser/setsid/tar work.
- Updates: same GitHub/Forgejo/manifest sources as Windows, sha256
  verified, pre-update pg_dump, automatic rollback when the new version
  does not come up.
- Non-loopback bind: generated bootstrap admin password and
  NETX_UME_VERIFY_TLS=true, as security_bootstrap requires.
- Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing
  libs); release-linux.yml builds on v* tags and smoke-tests offline on
  CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and
  openEuler 22.03 before attaching to the release.
- Windows: Setup DB page gets a bundled PG port field and
  /BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port";
  reconfigure keeps the configured port; postgresql.conf is written
  without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres).
- Forgejo/GitHub publish scripts include the Linux package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/linux/check_bundle.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Fail when any ELF in the stage needs glibc newer than MAX or a shared library
+# that is neither in the bundle nor on the base-system allowlist.
+#   check_bundle.sh <stage-dir> [max-glibc=2.17]
+set -euo pipefail
+STAGE="$1"
+MAX="${2:-2.17}"
+# Present on every glibc distro (libcrypt.so.1 only backs the unused _crypt module).
+ALLOW=" libc.so.6 libm.so.6 libdl.so.2 libpthread.so.0 librt.so.1 libutil.so.1 libcrypt.so.1 libnsl.so.1 libresolv.so.2 ld-linux-x86-64.so.2 libgcc_s.so.1 libstdc++.so.6 "
+
+is_elf() { [[ "$(head -c4 "$1" 2>/dev/null | od -An -c | tr -d ' ')" == '177ELF' ]]; }
+
+declare -A HAVE=()
+ELFS=()
+while IFS= read -r -d '' f; do
+  is_elf "${f}" && ELFS+=("${f}")
+done < <(find "${STAGE}" -type f \( -name '*.so*' -o -perm -u+x \) -print0)
+for f in "${ELFS[@]}"; do HAVE["$(basename "${f}")"]=1; done
+while IFS= read -r -d '' l; do HAVE["$(basename "${l}")"]=1; done < <(find "${STAGE}" -type l -name '*.so*' -print0)
+
+bad=0
+for f in "${ELFS[@]}"; do
+  top="$(objdump -T "${f}" 2>/dev/null | grep -o 'GLIBC_[0-9][0-9.]*' | sed 's/GLIBC_//' | sort -V | tail -n1 || true)"
+  if [[ -n "${top}" && "$(printf '%s\n%s\n' "${top}" "${MAX}" | sort -V | tail -n1)" != "${MAX}" ]]; then
+    echo "[FAIL] ${f#"${STAGE}"/} needs GLIBC_${top} (> ${MAX})"
+    bad=1
+  fi
+  while IFS= read -r need; do
+    need="${need##*/}" # $ORIGIN/../lib/libfoo.so -> libfoo.so
+    [[ -z "${need}" || "${ALLOW}" == *" ${need} "* ]] && continue
+    [[ -n "${HAVE[${need}]:-}" ]] && continue
+    echo "[FAIL] ${f#"${STAGE}"/} needs ${need} (not bundled)"
+    bad=1
+  done < <(readelf -d "${f}" 2>/dev/null | sed -n 's/.*(NEEDED).*\[\(.*\)\]/\1/p')
+done
+echo "==> checked ${#ELFS[@]} ELF files (max GLIBC ${MAX})"
+exit "${bad}"