feat: Flatpak packaging for the HeiniRemote agent

Bundles the agent as de.pc_heini.HeiniRemoteAgent on the freedesktop 24.08
runtime, mirroring the o3de-flatpak CI approach (bwrap-free build, OSTree
repo force-pushed to pages, single-file bundle attached to a Gitea release).
Compiles the agent from upstream source (newest v* tag, else main).

Sandbox notes: screen capture/input via portals need no special permission;
the PTY console uses flatpak-spawn --host for a real host shell, and a native
install's agent.toml is adopted read-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/get-latest-version.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Resolve which HeiniRemote revision to package. Prints eval-able output:
+#   version=<x.y.z or 0.0.0-git.<date>.<sha>>
+#   ref=<tag name or commit sha>
+#
+# Prefers the newest v* release tag on the upstream repo; while no release tag
+# exists yet, falls back to the tip of main (version derived from the commit).
+# UPSTREAM_URL may carry credentials (CI injects the actions token for private
+# repos); only derived values are printed.
+set -euo pipefail
+
+UPSTREAM_URL="${UPSTREAM_URL:-https://git.pc-heini.de/pc-heini/HeiniRemote.git}"
+
+tag=$(git ls-remote --tags "$UPSTREAM_URL" 'refs/tags/v*' \
+  | awk -F'refs/tags/' '{print $2}' \
+  | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+  | sort -V | tail -n1 || true)
+
+if [ -n "$tag" ]; then
+  echo "version=${tag#v}"
+  echo "ref=$tag"
+else
+  sha=$(git ls-remote "$UPSTREAM_URL" refs/heads/main | cut -c1-12)
+  [ -n "$sha" ] || { echo "ERROR: cannot resolve upstream main" >&2; exit 1; }
+  echo "version=0.0.0-git.$(date +%Y%m%d).$sha"
+  echo "ref=$sha"
+fi