Fix manifest for O3DE runtime reality found via .deb inspection

Inspecting o3de_2605_0.deb (control.tar md5sums) showed:
- everything installs under /opt/O3DE/<ver>/; no /usr glue, no app icon
- ~270 .so files sit beside the o3de launcher (LD_LIBRARY_PATH is required)
- the package depends on a build toolchain (clang/ninja/cmake/pkg-config)
- no Python runtime is bundled; O3DE fetches it into its install tree on
  first use, which is read-only in a Flatpak

Changes:
- run against org.freedesktop.Sdk so the build toolchain is present at runtime
- bake O3DE's Python in at build time via get_python.sh (network build-arg)
- drop the icon auto-grab (it would have installed a random asset SVG)
- document the remaining open risk: runtime writes into the read-only /app

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

org.o3de.O3DE.yaml

@@ -3,8 +3,12 @@
 # The workflow (and scripts/build.sh) download the latest o3de_*.deb to ./o3de.deb
 # next to this manifest before building, so the manifest itself never needs editing
 # when a new version drops.
+#
+# Why the SDK is the runtime (not just the sdk): O3DE compiles game-project code at
+# runtime and ships only a *build toolchain* dependency list (clang/ninja/cmake/
+# pkg-config + -dev libs). Those live in org.freedesktop.Sdk, so we run against it.
 id: org.o3de.O3DE
-runtime: org.freedesktop.Platform
+runtime: org.freedesktop.Sdk
 runtime-version: '24.08'
 sdk: org.freedesktop.Sdk
 command: o3de-wrapper.sh
@@ -25,25 +29,39 @@ finish-args:
 modules:
   - name: o3de
     buildsystem: simple
+    # The Python bootstrap step (below) downloads O3DE's Python runtime into the
+    # install tree, so this module needs network access during the build.
+    build-options:
+      build-args:
+        - --share=network
     build-commands:
       # The .deb is an `ar` archive containing data.tar.{gz,xz,zst}.
       - ar x o3de.deb
       - mkdir -p data
       - tar -C data -xf data.tar.*
-      # The payload lays files out under /opt (engine) and /usr (desktop/icon glue).
+      # The payload installs entirely under /opt/O3DE/<version>/. (The /usr branch
+      # is kept for robustness in case a future release adds desktop glue there.)
       - 'if [ -d data/opt ]; then mkdir -p "${FLATPAK_DEST}/opt"; cp -a data/opt/. "${FLATPAK_DEST}/opt/"; fi'
       - 'if [ -d data/usr ]; then cp -a data/usr/. "${FLATPAK_DEST}/"; fi'
+      # O3DE fetches its own Python runtime on first use, writing into its install
+      # tree. That tree is read-only at runtime in a Flatpak, so bake Python in now
+      # while ${FLATPAK_DEST} is still writable.
+      - |
+        set -e
+        ENGINE_DIR=$(find "${FLATPAK_DEST}/opt/O3DE" -mindepth 1 -maxdepth 1 -type d | head -n1)
+        echo "Engine dir: ${ENGINE_DIR}"
+        if [ -x "${ENGINE_DIR}/python/get_python.sh" ]; then
+          ( cd "${ENGINE_DIR}" && HOME="${PWD}" ./python/get_python.sh )
+        else
+          echo "::warning:: get_python.sh not found; Python may fail at runtime"
+        fi
       # Launcher + AppStream + desktop entry under the Flatpak app-id.
       - install -Dm755 o3de-wrapper.sh "${FLATPAK_DEST}/bin/o3de-wrapper.sh"
       - install -Dm644 org.o3de.O3DE.desktop "${FLATPAK_DEST}/share/applications/org.o3de.O3DE.desktop"
       - install -Dm644 org.o3de.O3DE.metainfo.xml "${FLATPAK_DEST}/share/metainfo/org.o3de.O3DE.metainfo.xml"
-      # Pick up an icon from the .deb if one is present and rename it to the app-id.
-      - |
-        icon=$(find data -type f \( -name '*o3de*.png' -o -name '*o3de*.svg' \) 2>/dev/null | head -n1)
-        if [ -n "$icon" ]; then
-          ext="${icon##*.}"
-          install -Dm644 "$icon" "${FLATPAK_DEST}/share/icons/hicolor/256x256/apps/org.o3de.O3DE.${ext}"
-        fi
+      # NOTE: the .deb ships no clean application icon (only in-editor asset icons),
+      # so none is installed; the desktop entry falls back to a generic icon. Drop a
+      # real logo into the repo and install it here to fix the launcher icon.
     sources:
       - type: file
         path: o3de.deb