ci(pi-gen): trixie everywhere + missing prerun.sh + EXPORT_IMAGE marker

Reverts misdiagnosis. pi-gen defaults to trixie since the Debian 13
release, which has gtk4 4.14 + libwebkitgtk-6.0 stock — no backports
needed. Build container, kiosk gtk feature gate, and pi-gen target all
realigned to trixie.

Actual reason last image run failed: our custom stage was missing the
mandatory prerun.sh (pi-gen calls it to seed ROOTFS_DIR from the
previous stage) and the EXPORT_IMAGE marker file (signals 'bake an
image at the end of this stage'). Both added.

Asset upload now globs deploy/*.img.xz so any extra exports stage2
produces ship alongside our customised one.

.github/workflows/build.yml

@@ -173,7 +173,8 @@ jobs:
         with:
           image-name: betterframe-client-${{ inputs.version }}
           stage-list: stage0 stage1 stage2 ./deploy/pi-gen/stage-betterframe-client
-          release: trixie
+          # pi-gen default release is trixie (Debian 13). Leave unset so we
+          # always track upstream pi-gen's current target.
           enable-ssh: 1
           username: bfadmin
           password: betterframe
@@ -182,9 +183,12 @@ jobs:
           hostname: betterframe-kiosk
           compression: xz
 
+      - name: List pi-gen output
+        run: ls -la deploy/ || true
+
       - name: Upload image to GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ inputs.tag }}
           files: |
-            deploy/image-betterframe-client-${{ inputs.version }}-lite.img.xz
+            deploy/*.img.xz

deploy/pi-gen/stage-betterframe-client/prerun.sh

@@ -0,0 +1,6 @@
+#!/bin/bash -e
+# Standard pi-gen prerun: bring in the previous stage's rootfs if our
+# working directory isn't already populated. Every pi-gen stage needs this.
+if [ ! -d "${ROOTFS_DIR}" ]; then
+    copy_previous
+fi

kiosk/Cargo.toml

@@ -7,7 +7,7 @@ license = "AGPL-3.0-only OR Commercial"
 
 [dependencies]
 # GTK4 for windowing/layout. v4_14 = Debian Trixie / Pi OS Trixie stock
-# libgtk-4-dev — keeps us on latest-stable without backports.
+# libgtk-4 — pi-gen defaults to trixie, so build chain + image are aligned.
 gtk4 = { version = "0.9", features = ["v4_14"] }
 
 # GStreamer for RTSP decode