chore(ci): pin linuxdeploy/appimagetool to immutable release tags (#122)

The AppImage workflow downloaded both tools from upstream 'continuous'
tags while pinning their SHA256s. Continuous assets get re-published and
silently change checksum, so the pin rotted and broke the 0.1.0 release
(linuxdeploy checksum mismatch). Pin to immutable versioned releases
(linuxdeploy 1-alpha-20251107-1, appimagetool 1.9.1) with digests
computed from those assets — URL and hash can no longer drift apart.

Author: thewrz

.github/workflows/appimage.yml

@@ -12,10 +12,15 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
-  # Pinned digests — update intentionally when upgrading these tools.
+  # Pinned tool releases + digests — update both together when upgrading.
+  # The old pins pointed at the upstream `continuous` tags, whose assets are
+  # re-published and silently change checksum (broke the 0.1.0 release).
+  # Immutable version tags keep download URL and digest in agreement.
   # Recompute: sha256sum <downloaded-file>
-  LINUXDEPLOY_SHA256: eb1cf4c2ef45ac66fde05fb82b1adbbb0096a5cb741f1123ca644ce800f816ff
-  APPIMAGETOOL_SHA256: a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0
+  LINUXDEPLOY_VERSION: 1-alpha-20251107-1
+  LINUXDEPLOY_SHA256: c20cd71e3a4e3b80c3483cef793cda3f4e990aca14014d23c544ca3ce1270b4d
+  APPIMAGETOOL_VERSION: 1.9.1
+  APPIMAGETOOL_SHA256: ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0
 
 jobs:
   build-appimage:
@@ -55,7 +60,7 @@ jobs:
       - name: Download and verify linuxdeploy
         run: |
           curl -fsSL -o linuxdeploy \
-            https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
+            "https://github.com/linuxdeploy/linuxdeploy/releases/download/${LINUXDEPLOY_VERSION}/linuxdeploy-x86_64.AppImage"
           echo "${LINUXDEPLOY_SHA256}  linuxdeploy" | sha256sum --check --strict
           chmod +x linuxdeploy
 
@@ -70,7 +75,7 @@ jobs:
       - name: Download and verify appimagetool
         run: |
           curl -fsSL -o appimagetool \
-            https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
+            "https://github.com/AppImage/appimagetool/releases/download/${APPIMAGETOOL_VERSION}/appimagetool-x86_64.AppImage"
           echo "${APPIMAGETOOL_SHA256}  appimagetool" | sha256sum --check --strict
           chmod +x appimagetool