Fix FUSE passthrough: use proper API, drop LD_LIBRARY_PATH, auto-apply cap

- Use fuse_passthrough_open/close API instead of raw fd assignment to
  fi->backing_id, which caused EIO on every file open through the VFS
- Remove LD_LIBRARY_PATH from launcher script — DT_RPATH handles lib
  resolution, and LD_LIBRARY_PATH triggers AT_SECURE which drops file
  capabilities (cap_sys_admin) needed for passthrough
- Auto-detect missing cap_sys_admin at mount time and prompt via pkexec
  to re-apply it (handles binary copy/update/extract losing the cap)
- Disable passthrough for session if fuse_passthrough_open fails, avoiding
  "Operation not permitted" spam in terminal
- Fix Nix flake: tinyxml2 → tinyxml-2, xorg.lib* → top-level names
- CI: eliminate artifact zip round-trip for GitHub releases

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 3 insertions, 15 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3ca6be..0212a31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: write
 
     steps:
@@ -75,23 +75,11 @@ jobs:
         with:
           name: Fluorine-Manager
           path: artifact/fluorine-manager.tar.gz
+          compression-level: 0
           if-no-files-found: warn
 
-  release:
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: Fluorine-Manager
-          path: artifact/
-
       - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
           files: artifact/fluorine-manager.tar.gz