Release: Flatpak x86_64/aarch64, AppImage zsync updates, README Downloads (#14)

- AppImages embed gh-releases-zsync update information and ship a .zsync beside them;
  the linux job installs zsync and checks both.
- New flatpak job (x86_64 on ubuntu-24.04, aarch64 on ubuntu-24.04-arm) repackages the
  linux tarball with packaging/linux/flatpak-bundle.sh and the new bundle manifest; the
  from-source manifest gets the same commented finish-args, and packaging-lint checks
  that the two agree.
- Jobs that sign nothing (version, linux, flatpak, web, FreeBSD packaging) no longer use
  the release environment, so a branch dispatch is a dry run; the draft-release job still
  needs the signed jobs and only runs on the release branch.
- README: Downloads section listing every build.

Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml

@@ -0,0 +1,49 @@
+# Flatpak manifest for the single-file bundle attached to every GitHub release
+# (gridcraft-<version>-linux-<arch>.flatpak). Build it with packaging/linux/flatpak-bundle.sh.
+#
+# It repackages the release's own Linux tarball (gridcraft-<version>-linux-<arch>.tar.gz,
+# built on Ubuntu 22.04 by package.sh) instead of compiling Rust inside flatpak-builder: no
+# network and no vendored crate sources during the build, a few seconds instead of 20+ minutes,
+# and byte-for-byte the same binaries as the AppImage/deb/rpm. The script unpacks the tarball
+# into `stage/` next to a copy of this file. The binaries need glibc >= 2.35 and load X11,
+# Wayland, xkbcommon and Vulkan/GL at runtime; the freedesktop runtime has all of them, and the
+# GPU driver comes from its org.freedesktop.Platform.GL extension.
+#
+# ai.storyteller.gridcraft.yml (same directory) is the from-source manifest for Flathub. Keep
+# runtime, runtime-version, sdk and finish-args identical in both (packaging-lint checks this).
+id: ai.storyteller.gridcraft
+runtime: org.freedesktop.Platform
+runtime-version: '25.08'
+sdk: org.freedesktop.Sdk
+command: gridcraft
+finish-args:
+  # Display: Wayland first; X11 only when no Wayland compositor is running.
+  - --socket=wayland
+  - --socket=fallback-x11
+  # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
+  - --share=ipc
+  # GPU access for rendering.
+  - --device=dri
+  # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
+  # portal, so broad filesystem access isn't needed. Documents and Downloads are granted for
+  # opening workbooks by path from the command line.
+  - --filesystem=xdg-documents
+  - --filesystem=xdg-download
+  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
+  # host agents) and home/host filesystem access.
+modules:
+  - name: gridcraft
+    buildsystem: simple
+    build-commands:
+      - install -Dm755 bin/gridcraft /app/bin/gridcraft
+      # Headless CLI and MCP server: `flatpak run --command=gridcraft-cli ai.storyteller.gridcraft`.
+      - install -Dm755 bin/gridcraft-cli /app/bin/gridcraft-cli
+      - install -Dm644 share/applications/ai.storyteller.gridcraft.desktop /app/share/applications/ai.storyteller.gridcraft.desktop
+      - install -Dm644 share/mime/packages/ai.storyteller.gridcraft.xml /app/share/mime/packages/ai.storyteller.gridcraft.xml
+      # Already has the release's version and date substituted by package.sh.
+      - install -Dm644 share/metainfo/ai.storyteller.gridcraft.metainfo.xml /app/share/metainfo/ai.storyteller.gridcraft.metainfo.xml
+      - mkdir -p /app/share/icons /app/share/doc && cp -R share/icons/hicolor /app/share/icons/ && cp -R share/doc/gridcraft /app/share/doc/
+    sources:
+      - type: dir
+        path: stage

packaging/linux/flatpak/ai.storyteller.gridcraft.yml

@@ -8,6 +8,8 @@
 #   flatpak run ai.storyteller.gridcraft
 #
 # For Flathub, replace the `dir` source with a `git` source pinned to a release tag and commit.
+# The single-file .flatpak attached to each release comes from ai.storyteller.gridcraft.bundle.yml,
+# which repackages the prebuilt release binaries. Keep runtime-version and finish-args identical.
 id: ai.storyteller.gridcraft
 runtime: org.freedesktop.Platform
 runtime-version: '25.08'
@@ -16,15 +18,21 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: gridcraft
 finish-args:
-  - --share=ipc
+  # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
+  # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
+  - --share=ipc
+  # GPU access for rendering.
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
   # portal, so broad filesystem access isn't needed. Documents and Downloads are granted for
   # opening workbooks by path from the command line.
   - --filesystem=xdg-documents
   - --filesystem=xdg-download
+  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
+  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
+  # host agents) and home/host filesystem access.
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: