fix(linux): address the review findings on steps 56 to 66

[datlechin]

Change

• release-linux.yml publishes only when the tagged commit is on the LINUX_BRANCH branch (linux when unset).
• The COPR and GitHub release jobs run under a linux-release environment, so the COPR token can be limited to linux-v* tags.
• The Linux release no longer takes the repository's latest release from macOS (--latest=false).
• Build Linux also runs when only linux-packages.yml or release-linux.yml changes, so zizmor audits them.
• A group name an earlier build stored past 64 characters or with control characters is cleaned on read instead of making the whole connection list unreadable. A blank stored group now reads as no group; group_round_trips_through_connections_document changes to match.
• SavedConnectionEditor runs an edit and a copy one at a time, so two windows saving the same connection cannot leave one edit's endpoint with the other's password.
• Fixes the red linux CI from refactor(linux): finish remediation steps 56 to 66 #3433:
  • Tests that run a fake ssh or askpass script write it through tablepro_test_support::write_executable, so a fork from another test thread cannot hold it open and make exec fail with ETXTBSY (a_failing_lookup_and_a_jump_loop_resolve_to_nothing). The askpass test's retry loop is gone.
  • The rpm requires libGLESv2.so.2: GTK's renderer loads it through libepoxy, which aborts without it, and on Fedora 44 neither gtk4 nor libepoxy declares it, so a default install aborted at startup.
  • The gtk suite runs under dbus-run-session with GNOTIFICATION_BACKEND=freedesktop, so the notification test has a bus inside the Flatpak build sandbox and never reaches the desktop it runs on.

Verified

• fmt and both clippy runs; nextest for tablepro-storage (167) and tablepro-test-support, tablepro-ssh, tablepro-test-fixtures (159) in ubuntu:26.04.
• actionlint and zizmor over the three Linux workflows.
• The app suites run in CI.

Before the first tag

• Create the linux-release environment, allow only linux-v* tags, and move COPR_CONFIG into it.