feat: Flatpak packaging for the HeiniRemote agent

Bundles the agent as de.pc_heini.HeiniRemoteAgent on the freedesktop 24.08
runtime, mirroring the o3de-flatpak CI approach (bwrap-free build, OSTree
repo force-pushed to pages, single-file bundle attached to a Gitea release).
Compiles the agent from upstream source (newest v* tag, else main).

Sandbox notes: screen capture/input via portals need no special permission;
the PTY console uses flatpak-spawn --host for a real host shell, and a native
install's agent.toml is adopted read-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/make-flatpak.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Assemble the HeiniRemote agent Flatpak WITHOUT flatpak-builder.
+#
+# Same approach as o3de-flatpak: flatpak-builder would run build commands
+# inside a bubblewrap sandbox (needs user namespaces / privileged CI). We
+# don't need that — the real build (cargo) happens outside this script, and
+# flatpak build-init/build-finish/build-export only touch files and the
+# OSTree repo.
+#
+# Inputs (env):
+#   AGENT_BIN         path to the compiled heiniremote-agent binary (required)
+#   WL_CLIPBOARD_DIR  dir containing wl-copy/wl-paste to bundle (default /usr/bin)
+#
+# Produces ./repo (an OSTree repo with branch "stable").
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+APP_ID=de.pc_heini.HeiniRemoteAgent
+RUNTIME_VER=24.08
+BRANCH=stable
+AGENT_BIN="${AGENT_BIN:?set AGENT_BIN to the compiled heiniremote-agent}"
+WL_DIR="${WL_CLIPBOARD_DIR:-/usr/bin}"
+
+rm -rf build-dir repo
+
+echo ">> build-init"
+flatpak build-init build-dir "$APP_ID" org.freedesktop.Sdk org.freedesktop.Platform "$RUNTIME_VER"
+DEST=build-dir/files
+
+echo ">> installing agent + bundled tools"
+install -Dm755 "$AGENT_BIN" "$DEST/bin/heiniremote-agent"
+# wl-clipboard is bundled because the agent's clipboard sync shells out to it
+# (clipboard.rs); the freedesktop runtime does not ship it.
+install -Dm755 "$WL_DIR/wl-copy" "$DEST/bin/wl-copy"
+install -Dm755 "$WL_DIR/wl-paste" "$DEST/bin/wl-paste"
+install -Dm755 heiniremote-wrapper.sh "$DEST/bin/heiniremote-wrapper.sh"
+install -Dm755 host-shell.sh "$DEST/bin/host-shell"
+
+echo ">> installing desktop metadata"
+install -Dm644 "$APP_ID.desktop" "$DEST/share/applications/$APP_ID.desktop"
+install -Dm644 "$APP_ID.metainfo.xml" "$DEST/share/metainfo/$APP_ID.metainfo.xml"
+install -Dm644 "$APP_ID.svg" "$DEST/share/icons/hicolor/scalable/apps/$APP_ID.svg"
+
+echo ">> build-finish (sandbox permissions)"
+# ScreenCast/RemoteDesktop run through xdg-desktop-portal, which sandboxed
+# apps may always talk to — no extra permission needed. What IS needed:
+#   network                     signaling wss + WebRTC/TURN
+#   wayland                     wl-copy/wl-paste talk to the compositor
+#   dri                         PipeWire screencast buffers may be dmabuf
+#   xdg-config/heiniremote:ro   adopt an existing native install's agent.toml
+#   StatusNotifier*             tray icon (ksni); non-fatal if absent. ksni
+#                               owns org.kde.StatusNotifierItem-{pid}-1 and
+#                               the wrapper exec's the agent, so inside the
+#                               sandbox the pid is deterministically 2
+#   org.freedesktop.Flatpak     flatpak-spawn --host for the rescue console's
+#                               real host shell — deliberate sandbox escape,
+#                               without it the console would show the sandbox
+flatpak build-finish build-dir \
+  --command=heiniremote-wrapper.sh \
+  --share=network \
+  --socket=wayland \
+  --device=dri \
+  --filesystem=xdg-config/heiniremote:ro \
+  --talk-name=org.kde.StatusNotifierWatcher \
+  --own-name=org.kde.StatusNotifierItem-2-1 \
+  --talk-name=org.freedesktop.Flatpak
+
+echo ">> export to OSTree repo"
+# --disable-sandbox: build-export validates icons in bwrap by default, which
+# fails in unprivileged CI containers; this runs the same validation in-process.
+flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
+flatpak build-update-repo repo --title="HeiniRemote Agent" --prune --prune-depth=1
+
+echo ">> done: ./repo"