Tasks

1. Advertise the AirPrint sub-type without the CUPS sub-type

1.1 Add BrowseDNSSDSubTypes _print,_universal to cupsd.conf with the reason (macOS treats a printer carrying _cups as shared and then withholds its AirPrint driver), and verify the directive name, its default and the way it forms the registered sub-type list against the CUPS 2.4 sources (scheduler/conf.c, scheduler/dirsvc.c)
1.2 Correct the README "macOS adds the printer as a Generic PostScript printer" section so it names the sub-type cause first, keeps the certificate as the second cause, and shows commands that actually report the advertisement; verify the documented avahi-browse commands are valid invocations of the installed Avahi client
1.3 Rebuild and redeploy the image on the podman host, then verify the advertisement: podman exec systemd-print-server avahi-browse -rt _ipp._tcp,_universal lists the queue and avahi-browse -rt _ipp._tcp,_cups does not list it (other CUPS servers on the network may appear there)
1.4 Verify nothing else regressed: ipptool -tv ipp://podp.local:631/printers/<queue> and the ipps:// variant report ipp status 0, and lpinfo -v on a CUPS client still resolves the queue to a dnssd://…/cups?uuid=… URI

2.1 On the Mac, remove the queue and add it again; verify the Use: popup offers AirPrint Printer, /etc/cups/ppd/<queue>.ppd contains *APAirPrint: True and lpoptions -p <queue> -l lists the duplex, colour and tray-2 options that the generic PPD hid

Archive this change (/opsx-archive) so the delta merges into openspec/specs/printserver/cups/spec.md.
Archive the still-open fix-ipps-certificate-lookup change once its live verification task is done.
Commit the implementation together with the archived changes using jj.