Wire up GitHub Actions for deb/brew build, test, and release

- Fix debian.yml: pin nfpm version, add permissions, improve test job
  with user creation, init test, and status check
- Fix homebrew.yml: use PyPI JSON API (macOS-compatible, no grep -oP),
  wait for PyPI availability on release, use generated formula not template,
  add Linux (Linuxbrew) test job alongside macOS
- Add release.yml orchestrator: pip → deb + brew + docker in order
- Add workflow_call triggers to pip.yml and docker.yml
- Fix build_brew.sh: replace grep -oP with Python-based PyPI API,
  add on_linux deps (pkg-config, openssl, libffi)
- Fix setup.sh: use GitHub API to find correct .deb download URL
  (filename includes version number)
- Fix postinstall.sh: create archivebox system user, pin version from
  package, check for systemd before daemon-reload
- Fix preremove.sh: stop service before removal, check for systemd
- Fix install.sh: fallback to latest if pinned version not on PyPI
- Add on_linux deps to brew formula for Linuxbrew support
- Tested: .deb builds, installs, creates user, runs archivebox init

https://claude.ai/code/session_01Vx1EsNrNySgsc8Y67dGzCn

bin/build_brew.sh

@@ -30,12 +30,21 @@ pip install --quiet "archivebox==${VERSION}" homebrew-pypi-poet 2>/dev/null
 echo "[+] Generating resource stanzas with homebrew-pypi-poet..."
 RESOURCES="$(poet archivebox)"
 
-# Get the sdist URL and SHA256 from PyPI
-SDIST_URL="$(pip download --no-binary :all: --no-deps -d "$TMPDIR/sdist" "archivebox==${VERSION}" 2>&1 | grep -oP 'https://\S+\.tar\.gz' | head -1 || true)"
+# Get the sdist URL and SHA256 from PyPI JSON API (works on macOS and Linux)
+PYPI_JSON="$(curl -fsSL "https://pypi.org/pypi/archivebox/${VERSION}/json" 2>/dev/null || echo '')"
+if [ -n "$PYPI_JSON" ]; then
+    SDIST_URL="$(echo "$PYPI_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((u['url'] for u in d['urls'] if u['packagetype']=='sdist'), ''))" 2>/dev/null || echo '')"
+    SDIST_SHA256="$(echo "$PYPI_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((u['digests']['sha256'] for u in d['urls'] if u['packagetype']=='sdist'), ''))" 2>/dev/null || echo '')"
+fi
 if [ -z "$SDIST_URL" ]; then
     SDIST_URL="https://files.pythonhosted.org/packages/source/a/archivebox/archivebox-${VERSION}.tar.gz"
 fi
-SDIST_SHA256="$(pip hash "$TMPDIR/sdist/"*.tar.gz 2>/dev/null | grep 'sha256:' | cut -d: -f2 || echo '')"
+if [ -z "$SDIST_SHA256" ]; then
+    # Fallback: download and compute locally
+    mkdir -p "$TMPDIR/sdist"
+    pip download --no-binary :all: --no-deps -d "$TMPDIR/sdist" "archivebox==${VERSION}" 2>/dev/null || true
+    SDIST_SHA256="$(shasum -a 256 "$TMPDIR/sdist/"*.tar.gz 2>/dev/null | awk '{print $1}' || echo '')"
+fi
 
 deactivate
 
@@ -68,6 +77,12 @@ class Archivebox < Formula
   depends_on "ripgrep"
   depends_on "yt-dlp"
 
+  on_linux do
+    depends_on "pkg-config" => :build
+    depends_on "openssl@3"
+    depends_on "libffi"
+  end
+
   # Python dependency resource blocks auto-generated by homebrew-pypi-poet
   # AUTOGENERATED_RESOURCES_START
 ${RESOURCES}