CI: build without flatpak-builder to avoid bwrap/privileged requirement

flatpak-builder sandboxes each build command in bubblewrap, which needs
user namespaces / a privileged job container that Gitea act_runner does
not grant by default (bwrap: Creating new namespace failed).

Replace it with scripts/make-flatpak.sh, which uses flatpak
build-init/build-finish/build-export plus plain-shell extraction and the
get_python.sh bake. None of these use bwrap, so an unprivileged container
works. The flatpak-builder manifest stays as a documented alternative.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/build.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# Build the O3DE Flatpak locally (for testing the manifest before relying on CI).
+# Build the O3DE Flatpak locally (same bwrap-free path CI uses).
 #
-# Requires: flatpak, flatpak-builder, curl, and the Flathub remote.
+# Requires: flatpak, curl, and the Flathub remote. (No flatpak-builder needed.)
 # Note: O3DE is large (~15-18 GB installed); expect a multi-GB download and a
 # build that needs a lot of free disk space.
 set -euo pipefail
@@ -22,20 +22,17 @@ else
   echo ">> No checksum published; skipping verification" >&2
 fi
 
-# Make sure the runtime/SDK are available (no-op if already installed).
+# Make sure the SDK runtime is available (no-op if already installed).
 flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-flatpak install --user -y flathub org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08 || true
+flatpak install --user -y flathub org.freedesktop.Sdk//24.08 || true
 
 echo ">> Building"
-flatpak-builder --user --force-clean --install-deps-from=flathub \
-  --repo=repo build-dir org.o3de.O3DE.yaml
+scripts/make-flatpak.sh
 
 cat <<EOF
 
->> Done.
-   Test run without installing:
-     flatpak-builder --run build-dir org.o3de.O3DE.yaml o3de-wrapper.sh
-   Or install from the local repo:
+>> Done. Install from the local repo to test:
      flatpak remote-add --user --no-gpg-verify o3de-local repo
      flatpak install --user o3de-local org.o3de.O3DE
+     flatpak run org.o3de.O3DE
 EOF

scripts/make-flatpak.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Build the O3DE Flatpak WITHOUT flatpak-builder.
+#
+# flatpak-builder runs every build command inside a bubblewrap sandbox, which
+# needs user namespaces / a privileged container - awkward in CI. We don't need
+# it: our "build" is just unpacking a .deb and running get_python.sh, both plain
+# shell. flatpak build-init/build-finish/build-export only touch files and the
+# OSTree repo (no bwrap), so this works in an unprivileged container.
+#
+# Expects ./o3de.deb to already be present. Produces ./repo (an OSTree repo).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+APP_ID=org.o3de.O3DE
+RUNTIME=org.freedesktop.Sdk
+RUNTIME_VER=24.08
+BRANCH=stable
+
+rm -rf build-dir data repo
+
+echo ">> build-init"
+flatpak build-init build-dir "$APP_ID" "$RUNTIME" "$RUNTIME" "$RUNTIME_VER"
+DEST=build-dir/files
+
+echo ">> extracting .deb payload"
+mkdir -p data
+ar x o3de.deb
+tar -C data -xf data.tar.*
+mkdir -p "$DEST/opt"
+cp -a data/opt/. "$DEST/opt/"
+
+echo ">> baking O3DE's Python runtime into the image"
+# O3DE fetches Python into its install tree on first use, but that tree is
+# read-only at runtime in a Flatpak, so populate it now while it is writable.
+ENGINE_DIR=$(find "$DEST/opt/O3DE" -mindepth 1 -maxdepth 1 -type d | head -n1)
+echo "   engine dir: $ENGINE_DIR"
+if [ -x "$ENGINE_DIR/python/get_python.sh" ]; then
+  ( cd "$ENGINE_DIR" && HOME="$PWD" ./python/get_python.sh )
+else
+  echo "   WARNING: get_python.sh not found; Python may fail at runtime" >&2
+fi
+
+echo ">> installing launcher + metadata"
+install -Dm755 o3de-wrapper.sh "$DEST/bin/o3de-wrapper.sh"
+install -Dm644 org.o3de.O3DE.desktop "$DEST/share/applications/$APP_ID.desktop"
+install -Dm644 org.o3de.O3DE.metainfo.xml "$DEST/share/metainfo/$APP_ID.metainfo.xml"
+
+echo ">> build-finish (command + sandbox permissions)"
+flatpak build-finish build-dir \
+  --command=o3de-wrapper.sh \
+  --share=ipc \
+  --share=network \
+  --socket=x11 \
+  --socket=fallback-x11 \
+  --socket=wayland \
+  --socket=pulseaudio \
+  --device=dri \
+  --device=all \
+  --filesystem=home \
+  --talk-name=org.freedesktop.Notifications \
+  --env=QT_QPA_PLATFORM=xcb
+
+echo ">> export to OSTree repo"
+flatpak build-export repo build-dir "$BRANCH"
+flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1
+
+echo ">> done: ./repo"