refactor: upstream-based multi-image pipeline, add fedora-cosmic

Build fedora-cosmic from the upstream Fedora manifests in
fedora/ostree/ci-test (44 and rawhide) with custom overlays:

- remove firefox from the base system
- add token2-fido-bridge + PC/SC smartcard stack and uhid
- install per-user Flatpaks on first login via a systemd user unit

Replace the legacy builder/changelog scripts with:
- build.sh: rpm-ostree compose image (upstream overlay or standalone)
- release.sh: package changelog published as Gitea releases

CI moves to the job-v2 runner with a build matrix, cosign signing and
release publishing. Drop the legacy asahi-cosmic/shared/base images,
builder.sh, changelog.sh, Containerfile and changelogs/.

images/fedora-cosmic/build.conf

@@ -0,0 +1,17 @@
+# Build configuration for images/fedora-cosmic. Sourced by build.sh.
+
+BUILD_MODE=upstream
+
+# Upstream Fedora atomic desktop manifests (fork of workstation-ostree-config).
+UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
+
+# Map the distro we build to an upstream branch.
+#   main  -> rawhide (currently releasever 46)
+#   f44   -> Fedora 44 stable
+declare -A UPSTREAM_REFS=(
+  [44]=f44
+  [rawhide]=main
+)
+
+# Fetch token2-fido-bridge from its GitHub releases into a local repo.
+TOKEN2=1