fix: improve Linux support across theme, keychain, updater, and packaging

- Disable window transparency on Linux and override --vibrancy to the
  solid background so vibrancy-surfaces no longer look washed out
- Replace Secret Service with a file-based vault key (mode 0600) on
  Linux to stop the keychain prompt firing every startup, with a
  migration path from legacy keyring entries
- Hide the window menu and title on Linux home screen
- Add bundle metadata (publisher, license, category, descriptions) so
  Ubuntu App Center / GNOME Software / KDE Discover show proper info
- Handle updater "platform not found" gracefully and surface a
  platform-specific keychain access toast
- Drop scripts/release-local.sh; CI handles multi-platform releases
- Document libfuse2 / chmod install notes and code signing status

Author: vdhieu

.github/workflows/release.yml

@@ -61,9 +61,8 @@ jobs:
           VERSION_NUMBER="${VERSION#v}"
           RELEASE_DATE=$(date -u +"%Y-%m-%d")
 
-          # Extract the full changelog section for this version from CHANGELOG.md.
-          # Include the ## [version] - date header so the format matches the local
-          # release script (release-local.sh generate_changelog output).
+          # Extract the full changelog section for this version from CHANGELOG.md,
+          # including the `## [version] - date` header.
           CHANGELOG_SECTION=$(awk "/^## \[$VERSION_NUMBER\]/{found=1} found && /^## \[/ && NR>1{exit} found" CHANGELOG.md 2>/dev/null || true)
 
           if [ -n "$CHANGELOG_SECTION" ]; then
@@ -603,11 +602,10 @@ jobs:
           VERSION_NUMBER="${VERSION#v}"
           PUB_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-          # Extract release notes body from CHANGELOG.md (body only, no version header —
-          # matches release-local.sh generate_manifest which uses the same awk pattern)
+          # Extract release notes body from CHANGELOG.md (body only, no version header).
           RAW_NOTES=$(awk "/^## \[$VERSION_NUMBER\]/{found=1;next} found && /^## \[/{exit} found" CHANGELOG.md 2>/dev/null | sed '/^[[:space:]]*$/d' || true)
 
-          # Fallback: generate from git commits (matches release-local.sh fallback)
+          # Fallback: generate release notes from git commits.
           if [ -z "$RAW_NOTES" ]; then
             PREV_TAG=$(git tag --sort=-version:refname | grep -v "^${VERSION}$" | head -n 1 || true)
             if [ -n "$PREV_TAG" ]; then

CHANGELOG.md

@@ -5,6 +5,27 @@
 <!-- The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), -->
 <!-- and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -->
 
+## [2026.1.0-beta.19] - 2026-04-11
+
+### Improvements
+- Populated Linux package metadata (publisher, homepage, license, category, description) so Query Pilot now shows a proper name, tagline, and links in GNOME Software, KDE Discover, and Ubuntu App Center instead of "unknown" / "(none)".
+- Disabled window transparency on Linux and switched to native GTK decorations with a solid themed background, fixing the broken look where the desktop bled through the sidebar.
+- Hid the File/Edit/View/Database/Window/Help menu bar and cleared the header bar title on Linux for a cleaner home screen, matching the macOS and Windows experience.
+- Made the "Keychain Access Required" toast platform-aware: macOS users see System Settings guidance, Windows users see Credential Manager guidance, and Linux users see GNOME Keyring / KWallet guidance.
+
+### Known Issues — Linux install
+
+- **AppImage silently does nothing when double-clicked.** Ubuntu 22.04+ ships FUSE 3 by default, but AppImages require FUSE 2. Install it with `sudo apt install libfuse2`, or run the AppImage with `--appimage-extract-and-run` to bypass FUSE entirely.
+- **AppImage is not executable by default.** Downloaded AppImages don't carry the execute bit. Right-click → Properties → Permissions → "Allow executing as program", or run `chmod +x Query-Pilot_*.AppImage`.
+- **`.deb` shows "Potentially unsafe — third-party package" in Ubuntu App Center** and runs a "Verifying query-pilot…" check on every launch. This is Ubuntu's handling for any side-loaded `.deb`; launching from the terminal or the `.desktop` shortcut bypasses it. A signed apt repository / Flatpak / Snap is on the roadmap.
+- **Login keyring locked → "Keychain Access Required" on every startup.** If you use auto-login, or your Ubuntu password drifted from your keyring password, the login keyring stays locked and Query Pilot cannot read its encryption key. Unlock it once in **Passwords and Keys** (Seahorse) → right-click **Login** → Unlock.
+
+### Known Issues — code signing
+
+- **macOS builds are signed and notarized.** No Gatekeeper warnings on first launch.
+- **Windows builds are not code-signed yet.** SmartScreen may show "Windows protected your PC" on first launch — click *More info* → *Run anyway*. Code signing is planned.
+- **Linux `.deb` / `.rpm` are not signed by a trusted apt/dnf key yet.** AppImage and RPM artifacts are GPG-signed, but there is no hosted apt repository, so `.deb` installs are treated as third-party by Ubuntu App Center.
+
 ## [2026.1.0-beta.18] - 2026-04-08
 
 ### Improvements

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help d dev dev-profile dp querypilot-cli build clean install test t test-all test-quick test-unit test-frontend test-backend test-integration ti test-watch test-coverage docker-up docker-down docker-reset seed-all seed-postgres seed-mysql seed-sqlite seed-sqlserver seed-oracle seed-mongodb seed-redis setup version release beta release-manual release-local relc generate-keys test-ssh-setup test-ssh test-ssh-all-adapters test-ssh-clean test-ssh-full test-ssh-all-smoke
+.PHONY: help d dev dev-profile dp querypilot-cli build clean install test t test-all test-quick test-unit test-frontend test-backend test-integration ti test-watch test-coverage docker-up docker-down docker-reset seed-all seed-postgres seed-mysql seed-sqlite seed-sqlserver seed-oracle seed-mongodb seed-redis setup version release beta release-manual generate-keys test-ssh-setup test-ssh test-ssh-all-adapters test-ssh-clean test-ssh-full test-ssh-all-smoke
 
 SSH_KEYGEN ?= ssh-keygen
 SQLSERVER_CONTAINER ?= query-pilot-sqlserver
@@ -70,7 +70,6 @@ help:
 	@echo "Release Management:"
 	@echo "  make release                       - Stable release (AI-assisted version + changelog)"
 	@echo "  make release beta                  - Beta release (auto-bump beta number)"
-	@echo "  make relc [V=2026.1.0]             - Local build, sign, notarize & upload"
 	@echo "  make version VERSION=2026.1.0      - Bump version only (no commit)"
 	@echo "  make generate-keys          - Generate Tauri updater signing keys"
 	@echo ""
@@ -434,11 +433,3 @@ version:
 	fi
 	@bash scripts/bump-version.sh $(VERSION)
 
-# Local release - build, sign, notarize, upload to GitHub
-# Usage: make relc V=0.7.1
-# Requires: gh CLI authenticated, Apple Developer cert in keychain
-# Optional env: APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID (for notarization)
-#               TAURI_PRIVATE_KEY, TAURI_KEY_PASSWORD (for update signing)
-#               SENTRY_DSN (for telemetry build)
-release-local relc:
-	@bash scripts/release-local.sh $(V)

README_DATABASES.md

@@ -563,5 +563,7 @@ rm seeds/sqlite/query_pilot_test.db
 
 # Remove any lingering data
 docker volume prune
+
+postgresql://postgres.zrrvnaooiflbelrqiiws:tnUkcHCR6SnDYaUE@aws-1-ap-southeast-1.pooler.supabase.com:6543/postgres
 ```