refactor: upstream-based multi-image pipeline, add fedora-cosmic

Build fedora-cosmic from the upstream Fedora manifests in
fedora/ostree/ci-test (44 and rawhide) with custom overlays:

- remove firefox from the base system
- add token2-fido-bridge + PC/SC smartcard stack and uhid
- install per-user Flatpaks on first login via a systemd user unit

Replace the legacy builder/changelog scripts with:
- build.sh: rpm-ostree compose image (upstream overlay or standalone)
- release.sh: package changelog published as Gitea releases

CI moves to the job-v2 runner with a build matrix, cosign signing and
release publishing. Drop the legacy asahi-cosmic/shared/base images,
builder.sh, changelog.sh, Containerfile and changelogs/.

images/fedora-cosmic/manifest.yaml

@@ -0,0 +1,23 @@
+# Custom Fedora COSMIC Atomic image.
+#
+# This is a thin downstream layer on top of the upstream Fedora manifests from
+# https://gitlab.com/fedora/ostree/ci-test, which are cloned into this directory
+# at build time by build.sh (see build.conf for the ref mapping).
+#
+# The upstream leaf manifest is `cosmic-atomic.yaml`, which pulls in
+# `cosmic-atomic-common.yaml` -> `common.yaml` + `packages/cosmic-atomic.yaml`.
+
+metadata:
+  summary: Fedora COSMIC Atomic (custom)
+
+variables:
+  # Opt out of the upstream `fedora.yaml` include so that we can ship our own
+  # Fedora integration package set without Firefox. This is the documented
+  # downstream hook (see the comment at the top of upstream's fedora.yaml).
+  distro: "fedora-cosmic"
+
+ref: fedora-cosmic/${releasever_ref}/${basearch}/cosmic
+
+include:
+  - cosmic-atomic.yaml
+  - custom.yaml