refactor: upstream-based multi-image pipeline, add fedora-cosmic

Build fedora-cosmic from the upstream Fedora manifests in
fedora/ostree/ci-test (44 and rawhide) with custom overlays:

- remove firefox from the base system
- add token2-fido-bridge + PC/SC smartcard stack and uhid
- install per-user Flatpaks on first login via a systemd user unit

Replace the legacy builder/changelog scripts with:
- build.sh: rpm-ostree compose image (upstream overlay or standalone)
- release.sh: package changelog published as Gitea releases

CI moves to the job-v2 runner with a build matrix, cosign signing and
release publishing. Drop the legacy asahi-cosmic/shared/base images,
builder.sh, changelog.sh, Containerfile and changelogs/.

images/fedora-cosmic/files/flatpak-user-firstboot

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Install the per-user Flatpaks listed in /usr/share/flatpak/flatpaks.list on
+# the first login of each user. Run as a systemd --user oneshot unit.
+set -euo pipefail
+
+LIST="/usr/share/flatpak/flatpaks.list"
+MARKER="${HOME}/.config/flatpak-user-firstboot.done"
+
+[[ -f "${LIST}" ]] || exit 0
+
+# Make Flathub available for the current user.
+flatpak remote-add --user --if-not-exists flathub \
+  https://flathub.org/repo/flathub.flatpakrepo
+
+mapfile -t apps < <(
+  sed -e 's/#.*//' -e 's/[[:space:]]//g' "${LIST}" | grep -v '^$' || true
+)
+
+if [[ ${#apps[@]} -gt 0 ]]; then
+  flatpak install --user --noninteractive --assumeyes "${apps[@]}"
+fi
+
+install -dm0755 "$(dirname "${MARKER}")"
+touch "${MARKER}"