Add Ubuntu source-checkout CI validation

[codeforester]

Summary

• Add an ubuntu-source-checkout GitHub Actions job for the v1.5.0 Ubuntu milestone.
• Install the hosted Ubuntu prerequisites used by the manual Parallels smoke test, prepare ~/.base.d/base/.venv, and run both basectl ci check and the full bin/base-test source-checkout suite.
• Add a workflow contract test and update docs/linux-support.md to record the new hosted Ubuntu validation lane.

Validation

• PYTHONPATH=lib/python:cli/python "$HOME/.base.d/base/.venv/bin/python" -m pytest cli/python/base_setup/tests/test_ci_supply_chain_policy.py -q
• git diff --check
• env -u BASE_HOME BASE_CACHE_DIR=/private/tmp/base-1328-base-test ./bin/base-test

Notes

• Part of Implement first supported Linux runtime target #562.
• Local ./bin/basectl ci check base --format json on this macOS sandbox is not useful evidence for the Ubuntu job: the sandbox blocks writes under ~/.base.d, and this machine is missing the Homebrew python@3.13 formula expected by the macOS check path. The full source-checkout runner passed with a writable BASE_CACHE_DIR.

Fixes #1328.