Harden Linux server runtime and packaging

Adds end-to-end Linux compatibility work for the dedicated server: new CI workflow (Ubuntu + Arch), line-ending/executable safeguards, and a local venv-first startup flow with split dependency files for server vs optional host GUI tooling. Improves runtime resilience with better bind error messages, stricter config validation, writable-state checks, cleaner socket/thread shutdown behavior, and SIGTERM-aware graceful stop handling for headless/systemd use. Updates deployment/startup docs and adds portability/runtime integration tests to lock in these behaviors.

cmake/stage_server.cmake

@@ -19,7 +19,11 @@ file(MAKE_DIRECTORY "${CO_SERVER_STAGE_DIR}")
 # Prefer a filtered copy so Python caches do not ship with the build.
 file(GLOB _server_entries RELATIVE "${CO_SERVER_SOURCE_DIR}" "${CO_SERVER_SOURCE_DIR}/*")
 foreach(_entry IN LISTS _server_entries)
-    if(_entry STREQUAL "__pycache__" OR _entry STREQUAL ".pytest_cache")
+    if(_entry STREQUAL "__pycache__"
+            OR _entry STREQUAL ".pytest_cache"
+            OR _entry STREQUAL ".venv"
+            OR _entry STREQUAL "logs"
+            OR _entry STREQUAL "tests")
         continue()
     endif()
     file(COPY "${CO_SERVER_SOURCE_DIR}/${_entry}"
@@ -27,6 +31,8 @@ foreach(_entry IN LISTS _server_entries)
         PATTERN "__pycache__" EXCLUDE
         PATTERN "*.pyc" EXCLUDE
         PATTERN ".pytest_cache" EXCLUDE
+        PATTERN ".venv" EXCLUDE
+        PATTERN "logs" EXCLUDE
     )
 endforeach()