feat: Flatpak packaging for the HeiniRemote agent

Bundles the agent as de.pc_heini.HeiniRemoteAgent on the freedesktop 24.08
runtime, mirroring the o3de-flatpak CI approach (bwrap-free build, OSTree
repo force-pushed to pages, single-file bundle attached to a Gitea release).
Compiles the agent from upstream source (newest v* tag, else main).

Sandbox notes: screen capture/input via portals need no special permission;
the PTY console uses flatpak-spawn --host for a real host shell, and a native
install's agent.toml is adopted read-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

heiniremote-wrapper.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Flatpak entry point for the HeiniRemote agent.
+#
+# Two sandbox adaptations, no agent code changes:
+#
+# 1. The PTY console (agent's console.rs) spawns $SHELL. Inside the sandbox
+#    that would be a sandboxed shell showing the Flatpak filesystem — useless
+#    as a rescue console. Point it at the host-shell bridge instead, which
+#    escapes to the real host login shell via flatpak-spawn.
+#
+# 2. Config migration: the agent reads $XDG_CONFIG_HOME/heiniremote/agent.toml,
+#    which Flatpak redirects to ~/.var/app/<id>/config/. If no config exists
+#    there yet but a native install left one at ~/.config/heiniremote/
+#    (visible read-only via --filesystem=xdg-config/heiniremote:ro), use that
+#    via the agent's HEINIREMOTE_CONFIG override.
+export SHELL=/app/bin/host-shell
+
+if [ -z "${HEINIREMOTE_CONFIG:-}" ] \
+    && [ ! -f "${XDG_CONFIG_HOME:-$HOME/.config}/heiniremote/agent.toml" ] \
+    && [ -f "$HOME/.config/heiniremote/agent.toml" ]; then
+    export HEINIREMOTE_CONFIG="$HOME/.config/heiniremote/agent.toml"
+fi
+
+exec /app/bin/heiniremote-agent "$@"