feat: Flatpak packaging for the HeiniRemote agent

Bundles the agent as de.pc_heini.HeiniRemoteAgent on the freedesktop 24.08
runtime, mirroring the o3de-flatpak CI approach (bwrap-free build, OSTree
repo force-pushed to pages, single-file bundle attached to a Gitea release).
Compiles the agent from upstream source (newest v* tag, else main).

Sandbox notes: screen capture/input via portals need no special permission;
the PTY console uses flatpak-spawn --host for a real host shell, and a native
install's agent.toml is adopted read-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

host-shell.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Host-shell bridge for the agent's PTY console.
+#
+# The wrapper sets SHELL=/app/bin/host-shell, so the agent's PTY console
+# spawns this instead of a sandboxed shell. flatpak-spawn --host (requires
+# --talk-name=org.freedesktop.Flatpak) runs the command on the host with the
+# PTY fds forwarded, giving the remote console a real host login shell.
+#
+# The inner resolution runs ON THE HOST: flatpak-spawn forwards the sandbox
+# environment, so $SHELL would still point at this script — resolve the user's
+# real login shell from passwd instead and fix up $SHELL before exec'ing it.
+exec flatpak-spawn --host /bin/sh -c '
+    shell="$(getent passwd "$(id -un)" | cut -d: -f7)"
+    [ -x "$shell" ] || shell=/bin/sh
+    export SHELL="$shell"
+    exec "$shell" -l
+'