Fix manifest for O3DE runtime reality found via .deb inspection

Inspecting o3de_2605_0.deb (control.tar md5sums) showed:
- everything installs under /opt/O3DE/<ver>/; no /usr glue, no app icon
- ~270 .so files sit beside the o3de launcher (LD_LIBRARY_PATH is required)
- the package depends on a build toolchain (clang/ninja/cmake/pkg-config)
- no Python runtime is bundled; O3DE fetches it into its install tree on
  first use, which is read-only in a Flatpak

Changes:
- run against org.freedesktop.Sdk so the build toolchain is present at runtime
- bake O3DE's Python in at build time via get_python.sh (network build-arg)
- drop the icon auto-grab (it would have installed a random asset SVG)
- document the remaining open risk: runtime writes into the read-only /app

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -113,10 +113,29 @@ The first iteration publishes an unsigned repo for simplicity. To sign:
 
 ## Caveats & things to verify
 
-- **The `.deb` internal layout is assumed** (`/opt/O3DE/<ver>/…` with the
-  `o3de` binary under `bin/Linux/…`). If a future release changes this, adjust
-  `o3de-wrapper.sh` and the manifest's copy commands. The first real build will
-  confirm it.
+These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
+
+- **Layout is confirmed for now**: the package installs everything under
+  `/opt/O3DE/<ver>/`, with the launcher at `bin/Linux/profile/Default/o3de` and
+  ~270 `.so` files beside it (hence the wrapper's `LD_LIBRARY_PATH`). If a future
+  release moves things, adjust `o3de-wrapper.sh` and the manifest.
+- **Runs against `org.freedesktop.Sdk`, not `Platform`.** O3DE's package
+  dependencies are a *build toolchain* (clang/ninja/cmake/pkg-config) because the
+  engine compiles project code at runtime. Those live in the SDK. Users therefore
+  pull the SDK runtime (larger than Platform) on install — Flatpak does this
+  automatically from Flathub.
+- **Python is baked in at build time.** O3DE normally downloads its Python runtime
+  into its own install tree on first use, but that tree is read-only inside a
+  Flatpak. The manifest runs `python/get_python.sh` during the build (with network
+  access) so Python is part of the immutable image. **This is the most likely step
+  to need tweaking** — verify it on the first real CI build.
+- **Runtime writes into the install tree may still fail.** Anything O3DE tries to
+  `pip install` or generate *inside* `/opt/O3DE/...` at runtime (e.g. per-gem
+  Python deps when building certain projects) will hit the read-only `/app`. Base
+  project building should work; exotic gems may not. This is the main open risk.
+- **No launcher icon yet.** The `.deb` ships only in-editor asset icons, so the
+  desktop entry uses a generic icon. Drop a real O3DE logo into the repo and
+  install it in the manifest to fix this.
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.