feat(dx): headless L2 script and smoke workflow (#1487, part 2)

[ZhuchkaTriplesix]

Summary

Section 2 of #1487: define the L2 headless level as one command, and use it in CI. Section 1 is #1617; section 3 (extension-author container) is not started. This PR says Refs.

• scripts/dev/headless_app.sh: finds a free X display, starts Xvfb, runs a copy of the bundle with QUERYA_PORTABLE=1 (the profile is a throw-away QueryaData and the built bundle stays clean), waits for a window (xdotool, or xwininfo; without either it only checks the process stays alive), keeps watching for --keep seconds to catch a crash right after start, optionally screenshots (import), stops the app and Xvfb, and removes the temp directory. Exit codes: 0 ok, 1 died / no window (with the last 40 lines of the app output), 2 usage / missing bundle or tool.
• .github/workflows/headless-smoke.yml: builds the Linux release bundle on a runner and runs the script with a screenshot and a log, uploaded as an artifact. It is a separate workflow because a Linux build takes minutes: it runs on changes to the script or the workflow, weekly, and on demand, not on every PR.
• docs/dev-containers.md: the level table is three one-liners now, with a section for L2.

Checked

• bash -n, --help and the "missing bundle" path (exit 2) locally. Xvfb is not installed on my machine, so the real run is the new workflow on this PR (it triggers on the script path).

Open points

• On a bare Xvfb there is no window manager and no D-Bus session. The script wraps the app in dbus-run-session when it exists; secrets use the OS keyring, so the app may log keyring errors in this mode. That is fine for a start smoke, but if the app refuses to show a window without a keyring the workflow will tell.
• "Headless Querya" (core services without a window for querya-mcp) stays open, as in the issue.

Refs #1487