Release: Windows arm64, Flatpak aarch64, AppImage zsync updates, README Downloads (#9)

- Windows: add arm64 (aarch64-pc-windows-msvc) to the matrix. package.ps1, sign.ps1 and the
  WiX source already handled it; nothing in the dependency tree blocks the target (clippy -D
  warnings is clean for it).
- Flatpak: x86_64 and aarch64 bundles repackage the Linux job's tarball (PhotoCraft's
  approach: same binaries and embedded fonts as the AppImage/deb/rpm, no Rust build). The
  from-source manifest stays for Flathub; packaging-lint keeps the two in sync. Both now grant
  --socket=pulseaudio so slide-show audio/video plays in the sandbox.
- AppImage: embed gh-releases-zsync update information and publish the .zsync beside it.
- Jobs that sign nothing (version, linux, flatpak, freebsd, web) leave the release environment,
  so a branch dispatch is a dry run; the draft-release job now requires every build.
- README: Downloads section.

Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml

@@ -0,0 +1,51 @@
+# Flatpak manifest for the single-file bundle attached to every GitHub release
+# (deckcraft-<version>-linux-<arch>.flatpak). Build it with packaging/linux/flatpak-bundle.sh.
+#
+# It repackages the release's own Linux tarball (deckcraft-<version>-linux-<arch>.tar.gz, built
+# on Ubuntu 22.04 by package.sh with the craft-fonts embedded) instead of compiling Rust inside
+# flatpak-builder: no network and no vendored crate sources during the build, a few seconds
+# instead of 20+ minutes, and byte-for-byte the same binaries as the AppImage/deb/rpm. The script
+# unpacks the tarball into `stage/` next to a copy of this file. The binaries need glibc >= 2.35
+# and load X11, Wayland, xkbcommon, Vulkan and ALSA at runtime; the freedesktop runtime has all
+# of them, and the GPU driver comes from its org.freedesktop.Platform.GL extension.
+#
+# ai.storyteller.deckcraft.yml (same directory) is the from-source manifest for Flathub. Keep
+# runtime-version and finish-args identical in both (packaging-lint checks this).
+id: ai.storyteller.deckcraft
+runtime: org.freedesktop.Platform
+runtime-version: '25.08'
+sdk: org.freedesktop.Sdk
+command: deckcraft
+finish-args:
+  # Display: Wayland first; X11 only when no Wayland compositor is running.
+  - --socket=wayland
+  - --socket=fallback-x11
+  # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
+  - --share=ipc
+  # GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
+  - --device=dri
+  # Sound for audio and video in slide shows (cpal over ALSA, routed to PulseAudio/PipeWire by
+  # the runtime's ALSA plugin).
+  - --socket=pulseaudio
+  # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the
+  # document portal, so picked files work anywhere without broad filesystem access. Documents is
+  # granted so decks passed by path (the command line, Open Recent) work in the usual place.
+  - --filesystem=xdg-documents
+  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
+  # host agents) and home/host filesystem access.
+modules:
+  - name: deckcraft
+    buildsystem: simple
+    build-commands:
+      - install -Dm755 bin/deckcraft /app/bin/deckcraft
+      - install -Dm755 bin/deckcraft-cli /app/bin/deckcraft-cli
+      - install -Dm644 share/applications/ai.storyteller.deckcraft.desktop /app/share/applications/ai.storyteller.deckcraft.desktop
+      # .deckcraft; the runtime's shared-mime-info already knows the PowerPoint types.
+      - install -Dm644 share/mime/packages/ai.storyteller.deckcraft.xml /app/share/mime/packages/ai.storyteller.deckcraft.xml
+      # Already has the release's version and date substituted by package.sh.
+      - install -Dm644 share/metainfo/ai.storyteller.deckcraft.metainfo.xml /app/share/metainfo/ai.storyteller.deckcraft.metainfo.xml
+      - mkdir -p /app/share/icons /app/share/doc && cp -R share/icons/hicolor /app/share/icons/ && cp -R share/doc/deckcraft /app/share/doc/
+    sources:
+      - type: dir
+        path: stage

packaging/linux/flatpak/ai.storyteller.deckcraft.yml

@@ -8,6 +8,8 @@
 #   flatpak run ai.storyteller.deckcraft
 #
 # For Flathub, replace the `dir` source with a `git` source pinned to a release tag and commit.
+# The release's .flatpak bundles are built from ai.storyteller.deckcraft.bundle.yml instead (it
+# repackages the Linux tarball); keep runtime-version and finish-args identical in both.
 id: ai.storyteller.deckcraft
 runtime: org.freedesktop.Platform
 runtime-version: '25.08'
@@ -16,14 +18,23 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: deckcraft
 finish-args:
-  - --share=ipc
+  # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
+  # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
+  - --share=ipc
+  # GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
   - --device=dri
-  # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
-  # portal, so broad filesystem access isn't needed. Documents is granted for opening decks by
-  # path from the command line.
+  # Sound for audio and video in slide shows (cpal over ALSA, routed to PulseAudio/PipeWire by
+  # the runtime's ALSA plugin).
+  - --socket=pulseaudio
+  # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the
+  # document portal, so picked files work anywhere without broad filesystem access. Documents is
+  # granted so decks passed by path (the command line, Open Recent) work in the usual place.
   - --filesystem=xdg-documents
+  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
+  # host agents) and home/host filesystem access.
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: