build(linux): release notes, JSON upgraders, arm64, hotfix, user docs

[datlechin]

• CHANGELOG.md: the 198 [Unreleased] entries for unreleased fixes become a 3-line lead and 13 Added entries, the first release notes.
• Stored JSON: each document type gets upgrade steps, so an older file is upgraded in memory instead of refused. A failed step is UpgradeFailed. Golden v1 fixtures for connections and the workspace pin the formats.
• check_packaging.py: once the changelog has a heading for the version, or at a tag, it checks the changelog, spec %changelog and man page dates against the metainfo, and Release: 1%{?dist} at the tag.
• Metainfo lists every export format (CSV, JSON, SQL, Excel, Markdown, HTML, XML).
• arm64: linux-packages.yml takes arm64 and rpm-runners inputs on manual runs; the release builds the arm64 .rpm too. debian/control is Architecture: amd64 arm64.
• Hotfix: release-linux.yml runs by hand with a published tag and a revision ≥2, rebuilds the .deb from that release's tarballs (fetch-release-sources.sh, checked against SHA256SUMS) with build-source.sh --revision N --debian, and uploads to the PPA. Steps in linux/docs/releasing.md.
• tablepro --version; man page gets a version and date, FILES and BUGS.
• Packaging: Recommends a keyring provider, Suggests krb5 tools; the RPM ships CHANGELOG.md instead of the README.
• Docs: install and privacy in linux/README.md, new linux/docs/troubleshooting.md, Linux in SECURITY.md scope.
• Bug report template: install source, distribution and session, debugging information, journal and crash paths.
• SECURITY.md and the bug template commits also go to main in a separate PR.