feat: add RPM/Fedora support with DNF repository

[seifzellaban]

See design doc: docs/superpowers/specs/2026-05-29-rpm-fedora-support-design.md

Summary

• RPM packages: electron-builder now builds .rpm alongside .deb and .AppImage
• DNF repository: metadata-only repo on gh-pages (binaries stay on GitHub Releases), with GPG-signed repomd.xml
• CI integration: build, validate, sign, and validate-with-docker steps in the release workflow
• Download table: release body shows Fedora/RHEL rows with RPM links and DNF setup instructions
• Full validation: platform validation, release metadata checks, and staging tests all enforce RPM presence

Files changed

• scripts/: 6 new files (dnf-repo-lib, build/sign/validate-dnf-repository, validate-linux-rpm-package), 5 modified (appcast-lib, electron-release-lib, platform-validation-lib, release-assets-lib, release-metadata-lib)
• apps/desktop/: electron-builder config + staging + validation (3 modified, 1 new)
• .github/workflows/release-desktop.yml: RPM/DNF CI pipeline
• release/dnf/README.md: DNF usage docs

[jsgrrchg]

Hey, thanks this PR :) , it looks that is failing because it needs to specify author 'email' in the application package.json
It is required to set Linux .deb package maintainer. Or you can set maintainer in the custom linux options.

[seifzellaban]

Added "NeverWrite Maintainers jsgrrchg@users.noreply.github.com" to the RPM options, matching the existing .deb maintainer. Also added a test that asserts the RPM metadata is stable.

[jsgrrchg]

Hey @seifzellaban, thanks again for the RPM/Fedora groundwork here.

I reviewed the latest follow-up commits on the PR and pushed a few release-hardening fixes on top:

• RPM packages are now signed before upload, and RPM validation requires a trusted package signature.
• DNF repository metadata is now generated with createrepo_c from the actual signed RPM headers instead of handwritten primary.xml/filelists.xml metadata.
• Public Fedora/RHEL install instructions no longer depend on dnf config-manager; they write /etc/yum.repos.d/neverwrite.repo directly.
• The DNF validation path now does a real dnf install --downloadonly neverwrite check in CI.

Local validation passed with node --test scripts/*.test.mjs (58/58), syntax checks, workflow YAML parsing, and git diff --check. I could not run the real createrepo_c/rpm/rpmsign/Docker validation locally because those tools are not installed on this machine, so that part is covered by the GitHub Actions runner.

At the time I checked, Rust, Web Clipper, and validate were green; the desktop/release matrix jobs were still pending.

Give it a spin and let me know what you think ;)