Reject unsupported CARGO_BUILD_TARGET in FreeBSD packaging

Only x86_64-unknown-freebsd and aarch64-unknown-freebsd are valid; any other
value now fails before the build or packaging.

packaging/freebsd/package.sh

@@ -24,20 +24,29 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-ARCH="$(uname -m)"
-case "$ARCH" in
-  amd64 | x86_64) ARCH=x86_64 ;;
-  arm64 | aarch64) ARCH=aarch64 ;;
-  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
-esac
+# Cross-builds (release workflow sets CARGO_BUILD_TARGET) take the arch from the target, not the host.
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then
+  case "$CARGO_BUILD_TARGET" in
+    aarch64-unknown-freebsd) ARCH=aarch64 ;;
+    x86_64-unknown-freebsd) ARCH=x86_64 ;;
+    *) echo "unsupported CARGO_BUILD_TARGET $CARGO_BUILD_TARGET (expected x86_64-unknown-freebsd or aarch64-unknown-freebsd)" >&2; exit 2 ;;
+  esac
+else
+  ARCH="$(uname -m)"
+  case "$ARCH" in
+    amd64 | x86_64) ARCH=x86_64 ;;
+    arm64 | aarch64) ARCH=aarch64 ;;
+    *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+  esac
+fi
 BASENAME="gridcraft-$VERSION-freebsd-$ARCH"
 
 echo "==> GridCraft $VERSION for FreeBSD $ARCH"
 
 if [[ "$SKIP_BUILD" = 0 ]]; then
-  (cd "$ROOT" && cargo build --release --locked -p gridcraft -p gridcraft-cli)
+  (cd "$ROOT" && cargo build --release --locked -p gridcraft -p gridcraft-cli ${CARGO_BUILD_TARGET:+--target "$CARGO_BUILD_TARGET"})
 fi
-BIN="$CARGO_TARGET_DIR/release"
+BIN="$CARGO_TARGET_DIR/${CARGO_BUILD_TARGET:+$CARGO_BUILD_TARGET/}release"
 WORK="$CARGO_TARGET_DIR/freebsd-package"
 TREE="$WORK/$BASENAME"
 rm -rf "$WORK"
@@ -56,6 +65,7 @@ copy_docs "$TREE/share/doc/gridcraft"
 tar -C "$WORK" -czf "$DIST/$BASENAME.tar.gz" "$BASENAME"
 echo "wrote $DIST/$BASENAME.tar.gz"
 
-"$TREE/bin/gridcraft-cli" --version
+# A cross-built binary cannot run on the x86_64 host.
+if [[ -z "${CARGO_BUILD_TARGET:-}" ]]; then "$TREE/bin/gridcraft-cli" --version; fi
 echo "==> done"
 ls -lh "$DIST/$BASENAME.tar.gz"

packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml

@@ -22,6 +22,8 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
+  # Network access for update checks against GitHub.
+  - --share=network
   # GPU access for rendering.
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
@@ -29,9 +31,7 @@ finish-args:
   # opening workbooks by path from the command line.
   - --filesystem=xdg-documents
   - --filesystem=xdg-download
-  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. Home/host filesystem access is deliberately not granted.
 modules:
   - name: gridcraft
     buildsystem: simple

packaging/linux/flatpak/ai.storyteller.gridcraft.yml

@@ -23,6 +23,8 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
+  # Network access for update checks against GitHub.
+  - --share=network
   # GPU access for rendering.
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
@@ -30,9 +32,7 @@ finish-args:
   # opening workbooks by path from the command line.
   - --filesystem=xdg-documents
   - --filesystem=xdg-download
-  # Deliberately not granted: network (the optional --control channel listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.gridcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. Home/host filesystem access is deliberately not granted.
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: