Fix editable-install patch for 26.05 + unblock icon in unprivileged build

The previous patch matched a development-branch variable that does not
exist in release 2605.0, so the warning fired and the editable install was
not patched. In 2605.0 the -e is hardcoded in the pip command
("pip install -e ${package_folder_path}"); strip the -e there instead.

Also, flatpak build-export validates exported app icons in a bwrap sandbox,
which fails in an unprivileged container. Keep the icon inside the app (for
the running window/taskbar) but remove it from build-dir/export so export
skips validation. Host menu icon stays generic; build needs no privileges.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -133,17 +133,21 @@ These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
   home path, so it can only be created at runtime.
 - **The editable-install patch.** O3DE installs its own `o3de` CLI with
   `pip install -e`, which writes an `egg-info` next to the source under read-only
-  `/app` and fails. The build patches `cmake/LYPython.cmake` to use a normal
-  (non-editable) install, which builds in a temp dir and lands in the `~/.o3de`
-  venv. If a future O3DE release renames that variable, the build prints a warning
-  and Python setup will fail at runtime — that's the line to re-check.
+  `/app` and fails. The build patches `cmake/LYPython.cmake` to drop the `-e`, so
+  it's a normal install (built in a temp dir, landing in the writable `~/.o3de`
+  venv). If a future O3DE release changes that pip command, the build prints a
+  warning and Python setup will fail at runtime — that's the line to re-check.
 - **Other runtime writes into the install tree may still fail.** Anything else
   O3DE tries to generate *inside* `/opt/O3DE/...` at runtime (e.g. certain per-gem
   Python deps, or the engine-level asset cache) hits the read-only `/app`. Project
   data lives in your writable home dir, so normal project work should be fine;
   this is the main remaining open risk.
-- **Launcher icon** is shipped as `org.o3de.O3DE.png` (the `.deb` itself contains
-  only in-editor asset icons, none suitable as an app icon).
+- **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only
+  in-editor asset icons). It's kept *inside* the app so the running window/taskbar
+  shows it, but removed from the *exported* set because `flatpak build-export`
+  validates exported icons in a bwrap sandbox that fails in an unprivileged
+  container. Consequence: the host menu launcher icon is generic. A privileged
+  runner would let us export it properly.
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.

org.o3de.O3DE.yaml

@@ -43,10 +43,10 @@ modules:
       - |
         set -e
         LYPYTHON=$(find "${FLATPAK_DEST}/opt/O3DE" -path '*/cmake/LYPython.cmake' | head -n1)
-        if [ -n "$LYPYTHON" ] && grep -q 'set(_pip_install_mode_args "-e")' "$LYPYTHON"; then
-          sed -i 's/set(_pip_install_mode_args "-e")/set(_pip_install_mode_args "")/' "$LYPYTHON"
+        if [ -n "$LYPYTHON" ] && grep -qF -- '-m pip install -e ' "$LYPYTHON"; then
+          sed -i 's/-m pip install -e /-m pip install /g' "$LYPYTHON"
         else
-          echo "::warning:: editable-install line not found in LYPython.cmake"
+          echo "::warning:: 'pip install -e' not found in LYPython.cmake"
         fi
       # Launcher + AppStream + desktop entry under the Flatpak app-id.
       - install -Dm755 o3de-wrapper.sh "${FLATPAK_DEST}/bin/o3de-wrapper.sh"

scripts/make-flatpak.sh

@@ -37,11 +37,11 @@ echo ">> patching the editable pip install (read-only /app workaround)"
 # and installs into the writable ~/.o3de venv. (Nothing Python-related needs to
 # be baked into the image; it all lives per-user under ~/.o3de.)
 LYPYTHON=$(find "$DEST/opt/O3DE" -path '*/cmake/LYPython.cmake' | head -n1)
-if [ -n "$LYPYTHON" ] && grep -q 'set(_pip_install_mode_args "-e")' "$LYPYTHON"; then
-  sed -i 's/set(_pip_install_mode_args "-e")/set(_pip_install_mode_args "")/' "$LYPYTHON"
+if [ -n "$LYPYTHON" ] && grep -qF -- '-m pip install -e ' "$LYPYTHON"; then
+  sed -i 's/-m pip install -e /-m pip install /g' "$LYPYTHON"
   echo "   patched: $LYPYTHON"
 else
-  echo "   WARNING: editable-install line not found in LYPython.cmake; O3DE layout may have changed" >&2
+  echo "   WARNING: 'pip install -e' not found in LYPython.cmake; O3DE layout may have changed" >&2
 fi
 
 echo ">> installing launcher + metadata"
@@ -65,6 +65,12 @@ flatpak build-finish build-dir \
   --env=QT_QPA_PLATFORM=xcb
 
 echo ">> export to OSTree repo"
+# flatpak build-export validates exported app icons in a bwrap sandbox, which
+# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The
+# icon stays inside the app (so the running window/taskbar shows it); we just
+# drop it from the *exported* set so export skips validation. Trade-off: the
+# host menu launcher icon is generic. (A privileged runner would avoid this.)
+rm -rf build-dir/export/share/icons
 flatpak build-export repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1