Release: Flatpak x86_64/aarch64, AppImage zsync updates, README Downloads (#14)

- AppImages embed gh-releases-zsync update information and ship a .zsync beside them;
  the linux job installs zsync and checks both.
- New flatpak job (x86_64 on ubuntu-24.04, aarch64 on ubuntu-24.04-arm) repackages the
  linux tarball with packaging/linux/flatpak-bundle.sh and the new bundle manifest; the
  from-source manifest gets the same commented finish-args, and packaging-lint checks
  that the two agree.
- Jobs that sign nothing (version, linux, flatpak, web, FreeBSD packaging) no longer use
  the release environment, so a branch dispatch is a dry run; the draft-release job still
  needs the signed jobs and only runs on the release branch.
- README: Downloads section listing every build.

Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/freebsd.yml

@@ -1,7 +1,8 @@
 # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
-# Builds run only from the `release` branch: release.yml calls this workflow, and a manual run
-# from any other branch is skipped.
+# Test builds run only from the `release` branch (a manual run from any other branch is skipped).
+# Packaging runs (release.yml calls it that way) run from any branch, so a release.yml dry run
+# from a branch builds the tarball too; they need no secrets.
 #
 # With `package: true` (release.yml calls it that way, or a manual run) it instead builds the
 # release binaries and uploads `gridcraft-<version>-freebsd-x86_64.tar.gz` as the
@@ -41,7 +42,7 @@ permissions:
 jobs:
   freebsd:
     name: FreeBSD 14 (${{ inputs.package && 'package' || 'build + test' }})
-    if: github.ref == 'refs/heads/release'
+    if: github.ref == 'refs/heads/release' || inputs.package
     runs-on: ubuntu-latest
     timeout-minutes: 300
     env: