Release: Flatpak x86_64 + aarch64 bundles, AppImage zsync auto-update, README Downloads (#22)

- packaging/linux/package.sh: embed gh-releases-zsync update information in each AppImage
  (appimagetool -u) and write the .zsync beside it; the Linux job installs zsync and checks both.
- New flatpak job (x86_64 on ubuntu-24.04, aarch64 on ubuntu-24.04-arm) repackages the Linux
  tarball with packaging/linux/flatpak-bundle.sh and ai.storyteller.wordcraft.bundle.yml; no Rust
  build, no release environment. The release job needs it.
- version, Linux and web jobs drop `environment: release` (they sign nothing), so a branch
  workflow_dispatch dry-runs every unsigned job; the release job still needs the signed jobs.
- FreeBSD release build embeds craft-fonts like the other desktop builds and ships its licences.
- Flathub manifest: same finish-args as the bundle (adds xdg-documents), builds the CLI too;
  packaging-lint checks both manifests agree.
- README: Downloads section; docs/releasing.md updated.

Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

docs/releasing.md

@@ -12,7 +12,7 @@ this file has the WordCraft specifics.
 |---|---|---|
 | macOS | universal `WordCraft.app` in a `.dmg`, universal CLI zip | Developer ID + notarization (`APPLE_*` secrets) |
 | Windows | x64, x86 and arm64 `.msi` + portable `.zip` | Azure Trusted Signing (`AZURE_*` secrets) |
-| Linux | x86_64 and aarch64 `.AppImage`, `.deb`, `.rpm`, `.tar.gz`; Flatpak manifest | checksums |
+| Linux | x86_64 and aarch64 `.AppImage` (+ `.zsync` for AppImageUpdate), `.flatpak` bundle, `.deb`, `.rpm`, `.tar.gz`; Flathub manifest | checksums |
 | FreeBSD | x86_64 `.tar.gz` | checksums |
 | Web | `wordcraft-web-<version>.zip` (static site: `index.html`, wasm, glue) | none |
 
@@ -23,4 +23,8 @@ synced from the release manager's machine (`craftrules/release/signing-setup.md`
 produce unsigned builds with a warning, so forks still build.
 
 Local packaging: `packaging/macos/package.sh --arch universal`, `packaging/windows/package.ps1`,
-`packaging/linux/package.sh`, `packaging/web/package.sh`.
+`packaging/linux/package.sh` (then `packaging/linux/flatpak-bundle.sh` for the Flatpak), `packaging/web/package.sh`.
+
+Dry run: `gh workflow run release.yml --ref <branch>` builds the unsigned jobs (version, Linux,
+Flatpak, FreeBSD, web) on any branch; the signing jobs are refused there by the `release`
+environment's branch rule, so no draft release is made.