feat(max): add MAX messenger package, sandboxed with Firejail

MAX is the Russian state-affiliated messenger; the official Qt6 client is
repacked from download.max.ru with no independent security track record,
so it never runs unsandboxed. /usr/bin/max is a wrapper (not a symlink)
that always launches through `firejail --profile=max`; the .desktop Exec
goes through the same wrapper so there's no launch path that bypasses it.
The profile hides the rest of the home directory behind private ~/.config,
~/.cache and ~/.local/share/max subdirectories, drops capabilities, enables
seccomp, blocks system D-Bus, and blacklists the standalone crashpad_handler
crash-report uploader. Full elimination of first-party telemetry isn't
claimed or possible from the sandbox layer alone — documented in LICENSE.

Also wires up repo-wide bookkeeping now that all three package changes
(telegram-desktop -> telegram rename, vk-messenger, max) are in: README
package count/catalog rows, docs/maintenance.md naming table and directory
count, and tools/package_updates.sh + tools/validate_repo.py package lists.

max/postremove.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -euo pipefail
+
+optional_refresh() {
+    local label=$1
+    shift
+    if ! "$@"; then
+        echo "Предупреждение: не удалось обновить ${label}." >&2
+    fi
+}
+
+if command -v update-desktop-database >/dev/null 2>&1; then
+    optional_refresh "desktop-базу" update-desktop-database -q /usr/share/applications
+fi
+
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+    optional_refresh "кэш иконок" gtk-update-icon-cache -f -q /usr/share/icons/hicolor
+fi
+
+if command -v kbuildsycoca6 >/dev/null 2>&1; then
+    optional_refresh "кэш KDE" kbuildsycoca6 --noincremental
+elif command -v kbuildsycoca5 >/dev/null 2>&1; then
+    optional_refresh "кэш KDE" kbuildsycoca5 --noincremental
+fi