Fix manifest for O3DE runtime reality found via .deb inspection

Inspecting o3de_2605_0.deb (control.tar md5sums) showed:
- everything installs under /opt/O3DE/<ver>/; no /usr glue, no app icon
- ~270 .so files sit beside the o3de launcher (LD_LIBRARY_PATH is required)
- the package depends on a build toolchain (clang/ninja/cmake/pkg-config)
- no Python runtime is bundled; O3DE fetches it into its install tree on
  first use, which is read-only in a Flatpak

Changes:
- run against org.freedesktop.Sdk so the build toolchain is present at runtime
- bake O3DE's Python in at build time via get_python.sh (network build-arg)
- drop the icon auto-grab (it would have installed a random asset SVG)
- document the remaining open risk: runtime writes into the read-only /app

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -113,10 +113,29 @@ The first iteration publishes an unsigned repo for simplicity. To sign:
 
 ## Caveats & things to verify
 
-- **The `.deb` internal layout is assumed** (`/opt/O3DE/<ver>/…` with the
-  `o3de` binary under `bin/Linux/…`). If a future release changes this, adjust
-  `o3de-wrapper.sh` and the manifest's copy commands. The first real build will
-  confirm it.
+These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
+
+- **Layout is confirmed for now**: the package installs everything under
+  `/opt/O3DE/<ver>/`, with the launcher at `bin/Linux/profile/Default/o3de` and
+  ~270 `.so` files beside it (hence the wrapper's `LD_LIBRARY_PATH`). If a future
+  release moves things, adjust `o3de-wrapper.sh` and the manifest.
+- **Runs against `org.freedesktop.Sdk`, not `Platform`.** O3DE's package
+  dependencies are a *build toolchain* (clang/ninja/cmake/pkg-config) because the
+  engine compiles project code at runtime. Those live in the SDK. Users therefore
+  pull the SDK runtime (larger than Platform) on install — Flatpak does this
+  automatically from Flathub.
+- **Python is baked in at build time.** O3DE normally downloads its Python runtime
+  into its own install tree on first use, but that tree is read-only inside a
+  Flatpak. The manifest runs `python/get_python.sh` during the build (with network
+  access) so Python is part of the immutable image. **This is the most likely step
+  to need tweaking** — verify it on the first real CI build.
+- **Runtime writes into the install tree may still fail.** Anything O3DE tries to
+  `pip install` or generate *inside* `/opt/O3DE/...` at runtime (e.g. per-gem
+  Python deps when building certain projects) will hit the read-only `/app`. Base
+  project building should work; exotic gems may not. This is the main open risk.
+- **No launcher icon yet.** The `.deb` ships only in-editor asset icons, so the
+  desktop entry uses a generic icon. Drop a real O3DE logo into the repo and
+  install it in the manifest to fix this.
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.

org.o3de.O3DE.yaml

@@ -3,8 +3,12 @@
 # The workflow (and scripts/build.sh) download the latest o3de_*.deb to ./o3de.deb
 # next to this manifest before building, so the manifest itself never needs editing
 # when a new version drops.
+#
+# Why the SDK is the runtime (not just the sdk): O3DE compiles game-project code at
+# runtime and ships only a *build toolchain* dependency list (clang/ninja/cmake/
+# pkg-config + -dev libs). Those live in org.freedesktop.Sdk, so we run against it.
 id: org.o3de.O3DE
-runtime: org.freedesktop.Platform
+runtime: org.freedesktop.Sdk
 runtime-version: '24.08'
 sdk: org.freedesktop.Sdk
 command: o3de-wrapper.sh
@@ -25,25 +29,39 @@ finish-args:
 modules:
   - name: o3de
     buildsystem: simple
+    # The Python bootstrap step (below) downloads O3DE's Python runtime into the
+    # install tree, so this module needs network access during the build.
+    build-options:
+      build-args:
+        - --share=network
     build-commands:
       # The .deb is an `ar` archive containing data.tar.{gz,xz,zst}.
       - ar x o3de.deb
       - mkdir -p data
       - tar -C data -xf data.tar.*
-      # The payload lays files out under /opt (engine) and /usr (desktop/icon glue).
+      # The payload installs entirely under /opt/O3DE/<version>/. (The /usr branch
+      # is kept for robustness in case a future release adds desktop glue there.)
       - 'if [ -d data/opt ]; then mkdir -p "${FLATPAK_DEST}/opt"; cp -a data/opt/. "${FLATPAK_DEST}/opt/"; fi'
       - 'if [ -d data/usr ]; then cp -a data/usr/. "${FLATPAK_DEST}/"; fi'
+      # O3DE fetches its own Python runtime on first use, writing into its install
+      # tree. That tree is read-only at runtime in a Flatpak, so bake Python in now
+      # while ${FLATPAK_DEST} is still writable.
+      - |
+        set -e
+        ENGINE_DIR=$(find "${FLATPAK_DEST}/opt/O3DE" -mindepth 1 -maxdepth 1 -type d | head -n1)
+        echo "Engine dir: ${ENGINE_DIR}"
+        if [ -x "${ENGINE_DIR}/python/get_python.sh" ]; then
+          ( cd "${ENGINE_DIR}" && HOME="${PWD}" ./python/get_python.sh )
+        else
+          echo "::warning:: get_python.sh not found; Python may fail at runtime"
+        fi
       # Launcher + AppStream + desktop entry under the Flatpak app-id.
       - install -Dm755 o3de-wrapper.sh "${FLATPAK_DEST}/bin/o3de-wrapper.sh"
       - install -Dm644 org.o3de.O3DE.desktop "${FLATPAK_DEST}/share/applications/org.o3de.O3DE.desktop"
       - install -Dm644 org.o3de.O3DE.metainfo.xml "${FLATPAK_DEST}/share/metainfo/org.o3de.O3DE.metainfo.xml"
-      # Pick up an icon from the .deb if one is present and rename it to the app-id.
-      - |
-        icon=$(find data -type f \( -name '*o3de*.png' -o -name '*o3de*.svg' \) 2>/dev/null | head -n1)
-        if [ -n "$icon" ]; then
-          ext="${icon##*.}"
-          install -Dm644 "$icon" "${FLATPAK_DEST}/share/icons/hicolor/256x256/apps/org.o3de.O3DE.${ext}"
-        fi
+      # NOTE: the .deb ships no clean application icon (only in-editor asset icons),
+      # so none is installed; the desktop entry falls back to a generic icon. Drop a
+      # real logo into the repo and install it here to fix the launcher icon.
     sources:
       - type: file
         path: o3de.deb