[grade=D] Sprint 1: .gitignore, test_installer.sh, test_voice_bridge.sh, README, roadmap, desktop packages, CI improvements

- .gitignore: exclude __pycache__, *.pyc, build artifacts, .iso files
- tests/test_installer.sh: 17 assertions (syntax, VERSION walk-up,
  heredoc check, structural checks for partition/format/pacstrap/boot
  logic, desktop overlay presence)
- tests/test_voice_bridge.sh: 19 assertions (AST parse, --version,
  VERSION match, no hardcoded literal, class/method/import checks)
- README.md: SSOT docs, Makefile targets, test suite table, repo layout
- docs/roadmap.md: CI/tests/SSOT marked done, Phase 3 app status
- packages.x86_64.desktop: Plasma + apps overlay for desktop ISO
- CI workflow: Python AST check, VERSION SSOT gate, make check
- test_helper.sh: clean single export of path variables
- test_version.sh: skip __pycache__ in detector scan

All 8 test suites pass (90+ assertions).
Codex noted: grep-based structural assertions are not behavior tests;
desktop overlay packages need repo validation. These are Phase 3 followups.

.gitea/workflows/ci.yml

@@ -24,10 +24,69 @@ jobs:
             sudo apt-get install -y -qq make
           fi
 
+      - name: Install Python 3
+        run: |
+          if ! command -v python3 >/dev/null 2>&1; then
+            sudo apt-get install -y -qq python3
+          fi
+
       # ── Shellcheck ───────────────────────────────────────────────────
       - name: Run shellcheck on all shell scripts
         run: make lint
 
+      # ── Python AST validation ────────────────────────────────────────
+      - name: Validate Python syntax (AST parse)
+        run: |
+          set -e
+          for f in $(find packaging/scripts -name '*.py'); do
+            echo "Checking $f..."
+            python3 -c "import ast; ast.parse(open('$f').read())"
+            echo "  ✓ $f"
+          done
+
+      # ── VERSION SSOT consistency ─────────────────────────────────────
+      - name: Verify VERSION single-source-of-truth
+        run: |
+          set -e
+          VERSION="$(cat VERSION)"
+          echo "Canonical VERSION: $VERSION"
+
+          # Mirror must match
+          MIRROR="$(head -n1 packaging/archiso/airootfs/etc/samios-version)"
+          if [ "$VERSION" != "$MIRROR" ]; then
+            echo "ERROR: VERSION ($VERSION) != airootfs mirror ($MIRROR)"
+            echo "Fix: make version-sync"
+            exit 1
+          fi
+          echo "  ✓ airootfs mirror matches VERSION"
+
+          # PKGBUILD pkgver must resolve to VERSION (hyphen → underscore)
+          PKGVER="$(cd packaging/packages/samios-branding && source PKGBUILD >/dev/null 2>&1 && echo "$pkgver")"
+          EXPECTED_PKGVER="$(echo "$VERSION" | tr '-' '_')"
+          if [ "$PKGVER" != "$EXPECTED_PKGVER" ]; then
+            echo "ERROR: PKGBUILD pkgver ($PKGVER) != expected ($EXPECTED_PKGVER)"
+            exit 1
+          fi
+          echo "  ✓ PKGBUILD pkgver resolves to VERSION"
+
+          # No hardcoded version literal in production files
+          # (spot-check the main components)
+          for f in \
+            packaging/archiso/airootfs/usr/local/bin/samios \
+            packaging/scripts/samios-installer.sh \
+            packaging/scripts/voice-bridge.py \
+            packaging/scripts/samios-desktop-setup.sh; do
+            if grep -qE '(^|[^a-zA-Z0-9])0\.[1-9][0-9]*\.[0-9]+' "$f" 2>/dev/null; then
+              echo "ERROR: $f contains a hardcoded version literal"
+              grep -nE '(^|[^a-zA-Z0-9])0\.[1-9][0-9]*\.[0-9]+' "$f"
+              exit 1
+            fi
+          done
+          echo "  ✓ No hardcoded version literals in production components"
+
+          echo ""
+          echo "VERSION SSOT consistency check PASSED ✓"
+
       # ── Profile structure validation ─────────────────────────────────
       - name: Validate archiso profile structure
         run: |
@@ -99,5 +158,5 @@ jobs:
           echo "Profile structure validation PASSED ✓"
 
       # ── Test suite ───────────────────────────────────────────────────
-      - name: Run test suite
-        run: make test
+      - name: Run test suite (lint + tests)
+        run: make check