MIL-013: Debian container and Windows Sandbox checks

A Debian image (python:3.13-slim-bookworm with Xvfb and GNOME's window
manager) runs the linters, the whole test suite, the screenshots and the
smoke test of a PyInstaller Linux binary and of the source program, so no
window opens on the development machine. The screenshot tool works on
Linux, a smoke driver presses the known button with the virtual mouse, and
Windows Sandbox scripts are written (not run, they open a window on the
host). README and the wiki Install pages describe it. Review records
RC-077 (Python) and RC-078 (shell).

Task: MIL-013#2
Task: MIL-013#3
Task: MIL-013#4
Task: MIL-013#5
Task: MIL-013#6
Task: MIL-013#7
Task: MIL-013#9
Task: MIL-013#10

tools/docker/run-checks.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Run the linters and the whole test suite (with the e2e tests of the real Tk
+# window) on the virtual desktop.
+#
+# Purpose:  the quality gate without a desktop of the host (ADR-0005).
+# Usage:    run-checks.sh        (from the repository root, via in-container.sh)
+# Env:      see start-desktop.sh
+# Needs:    ruff, mypy, import-linter, pytest (the dev extra), the desktop
+# Exit:     0 only when every check passes
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+# shellcheck source=tools/docker/start-desktop.sh
+. tools/docker/start-desktop.sh
+
+python -m ruff check src tests tools
+python -m ruff format --check src tests tools
+python -m mypy
+lint-imports
+python -m pytest -ra -q
+echo "checks passed on desktop: ${DESKTOP_KIND}"