critical-fixes, swap module & gaming overhaul

- Fixed script crashes from `whiptail` Cancel/Esc under `set -e`. Added `_menu()`, `_checklist()` and `_inputbox()` wrappers with `|| true` to prevent premature exits.
- Resolved startup failures by using defaults instead of relying on unset variables with `set -u`.
- Hardened sudoers management — `_validate_sudoers()` writes to temp file, validates with `visudo -cf`, only copies if successful.
- Replaced `eval` in `_run_cmd` with safer `bash -c` execution.

Swap Management Module (`modules/swap.sh`)
- New standalone module with 9 internal functions and `manage_swap()` entry point.
- Btrfs CoW detection — applies `chattr +C` before swapfile creation to prevent mkswap rejection on Btrfs.
- Dynamic swappiness configuration — reads current system value instead of hardcoding 60, pre-fills inputbox with existing setting.
- Uses `/run/lock/debianito-swap.lock` for early init compatibility (added as option 9 in main menu).

Repository & Branch Migration (`modules/repos/migrate.sh`)
- Handles branch migration from stable (11/12) to Testing or SID with 5-screen UX flow.
- Persistent backup system — creates timestamped tar.gz backups of `/etc/apt/sources.list*`, auto-restores on apt update failure.
- SID guardrails — installs `apt-listbugs` and `apt-listchanges` before upgrade to warn about critical bugs in unstable packages.
- Dynamic menu options based on Debian version (SID shows only 1-2-3 Exit, non-SID includes backports + branch migration).
- New `_components_enabled()` helper detects current contrib/non-free state.

Gaming Module Overhaul
- Unified gaming checklist — merged i386 toggle into single prompt with lazy evaluation instead of separate pre-check.
- Lazy 32-bit architecture enablement — only enables i386 when needed (steam/lutris/i386 selected) and installs graphics drivers if `need_32bit=true`.
- New `_install_nvidia_32bit()` helper with proper driver detection, version pinning, and legacy/tesla variant handling.

Heroic & OpenRGB Downloads
- Heroic — fetches latest release from GitHub API using `jq` to extract amd64.deb URL, validates with `dpkg-deb --info`.
- OpenRGB — downloads from Codeberg Gitea API with SHA256 verification when available, fallback to `dpkg-deb` validation.
- Dynamic codename detection — now detects Bookworm vs Trixie at runtime instead of hardcoded static values for .deb download URLs.

|Other Improvements
- Renumbered main menu: 8=ZRAM, 9=Swap Management, 10=Extras, 11=Boot Rescue, 12=Exit.
- Improved `detect_storage()` — excludes loop/CD-ROM devices via `lsblk -e 7,11`, explicitly skips zram, detects USB/SD via `/sys/block/$name/removable`.
- Standardized SCROLL_HINT across all files with centralized readonly variable.

modules/gaming/tools.sh

@@ -26,34 +26,63 @@ install_lutris() {
 }
 
 install_openrgb() {
-    local url
-    if [ "$DEBIAN_VERSION" = "12" ]; then
-        url="https://codeberg.org/OpenRGB/OpenRGB/releases/download/release_candidate_1.0rc2/openrgb_1.0rc2_amd64_bookworm_0fca93e.deb"
-    elif [ "$DEBIAN_VERSION" = "13" ]; then
-        url="https://codeberg.org/OpenRGB/OpenRGB/releases/download/release_candidate_1.0rc2/openrgb_1.0rc2_amd64_trixie_0fca93e.deb"
-    else
-        echo "OpenRGB requires Debian 12 (Bookworm) or 13 (Trixie)."
-        return 1
-    fi
+    local deb_suffix
+    case "$DEBIAN_CODENAME" in
+        bookworm) deb_suffix="bookworm" ;;
+        trixie)   deb_suffix="trixie" ;;
+        *)
+            echo "OpenRGB requires Debian 12 (Bookworm) or 13 (Trixie)."
+            return 1
+            ;;
+    esac
 
     local deb_path="/tmp/openrgb.deb"
     local ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
 
-    _run_cmd "OpenRGB" "curl -L -o ${deb_path} -A '${ua}' '${url}'" "Downloading OpenRGB..."
+    _run_cmd "OpenRGB" "sudo apt install -y curl jq" "Installing dependencies..."
 
-    if [ ! -s "${deb_path}" ]; then
-        echo -e "${RED}[-]${NC} Download failed: empty or missing file."
-        rm -f "${deb_path}"
+    local json
+    json=$(curl -s --connect-timeout 10 \
+        "https://codeberg.org/api/v1/repos/OpenRGB/OpenRGB/releases?limit=1") || {
+        echo -e "${RED}Could not fetch OpenRGB releases from Codeberg API.${NC}"
+        return 1
+    }
+
+    local deb_url sha256
+    while IFS=' ' read -r url hash; do
+        deb_url="$url"
+        sha256="$hash"
+    done < <(echo "$json" | jq -r '
+        .[0].assets[] | select(.name | contains("amd64_'"${deb_suffix}"'.deb")) |
+        "\(.browser_download_url) \(.sha256 // "")"
+    ' 2>/dev/null)
+
+    if [ -z "$deb_url" ]; then
+        echo -e "${RED}Could not find OpenRGB .deb for ${DEBIAN_CODENAME^}.${NC}"
         return 1
     fi
 
-    echo -e "${GREEN}[+]${NC} Installing OpenRGB package..."
-    if ! sudo apt install -y "${deb_path}"; then
-        rm -f "${deb_path}"
-        echo -e "${RED}[-]${NC} Package installation failed."
-        return 1
+    _run_cmd "OpenRGB" "curl -L -o '${deb_path}' -A '${ua}' '${deb_url}'" "Downloading OpenRGB..."
+
+    if [ -n "$sha256" ]; then
+        if ! echo "$sha256  $deb_path" | sha256sum -c --strict; then
+            echo -e "${RED}SHA256 mismatch! Downloaded file may be corrupted. Removing.${NC}"
+            rm -f "$deb_path"
+            return 1
+        fi
+        echo -e "${GREEN}SHA256 verified.${NC}"
+    else
+        if ! dpkg-deb --info "$deb_path" >/dev/null 2>&1; then
+            echo -e "${RED}Downloaded .deb is corrupted. Removing.${NC}"
+            rm -f "$deb_path"
+            return 1
+        fi
+        echo -e "${YELLOW}No SHA256 in API, validated via dpkg-deb.${NC}"
     fi
 
+    sudo apt install -y "$deb_path"
+    rm -f "$deb_path"
+
     sudo modprobe i2c-dev
     if ! grep -q "^i2c-dev" /etc/modules 2>/dev/null; then
         echo "i2c-dev" | sudo tee -a /etc/modules >/dev/null
@@ -62,8 +91,7 @@ install_openrgb() {
     sudo udevadm control --reload-rules && sudo udevadm trigger
     sudo setcap cap_sys_rawio=ep /usr/bin/openrgb 2>/dev/null || true
 
-    rm -f "${deb_path}"
-    echo -e "${GREEN}OpenRGB installed. NOTE: You must reboot or log out/in for the 'i2c' group to take effect.${NC}"
+    echo -e "${GREEN}OpenRGB installed. Reboot or log out/in for i2c group to take effect.${NC}"
     _pause
 }