fix(flatpak): prune pf-client-core's windows-rs git dep from the sandbox manifest — offline build broken since a69a83b5

The flatpak's offline cargo build has failed on every run since the D3D11VA push:
pf-client-core now declares the same git-pinned `windows` dependency as the Windows
client (cfg(windows)-gated, never compiled on Linux), and `cargo --offline` needs
every DECLARED dependency's source just to build the unit graph — but windows-rs is
deliberately not vendored into cargo-sources.json (flatpak-builder would full-clone
the multi-GB repo; the reason prune-windows-lock.py exists). Removing the workspace
member alone no longer covers it.

New packaging/flatpak/prune-windows-toml.py (dependency-free, like its lock sibling)
strips windows-rs git entries from a manifest in place — single- or multi-line —
and the flatpak manifest runs it on crates/pf-client-core/Cargo.toml right after the
existing clients/windows member sed. Registry deps in the same cfg(windows) table
(wasapi, sdl3) are kept; they vendor normally.

Verified in a scratch worktree with both prunes applied: the TOML stays valid and
`cargo metadata` resolves ZERO windows-rs packages and zero git-source declarations
— nothing left for --offline to fetch. End-to-end proof is the flatpak CI run on
this push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/flatpak/prune-windows-toml.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Strip microsoft/windows-rs git dependency entries from a Cargo.toml, in place.
+
+The sibling of prune-windows-lock.py, for the OTHER place the un-vendored windows-rs git
+source leaks into the flatpak's offline build: `crates/pf-client-core` declares
+`windows = { git = ... }` under `[target.'cfg(windows)'.dependencies]` (the D3D11VA decode
+backend). The dependency is cfg-gated and never COMPILES on Linux, but `cargo --offline`
+still needs every declared dependency's source available just to build the unit graph — and
+windows-rs is deliberately not vendored into cargo-sources.json (flatpak-builder would
+full-clone the multi-GB repo; see prune-windows-lock.py). Removing the entry from the
+sandbox copy of the manifest is safe for a Linux-only build: nothing behind cfg(windows)
+is compiled, so nothing misses the crate.
+
+Removes any top-level `name = { ... git = "...github.com/microsoft/windows-rs..." ... }`
+entry, single- or multi-line (pf-client-core's spans a features array; the entry ends at
+the first line that closes back to depth 0). Registry deps in the same table (wasapi,
+sdl3) are kept — they vendor normally.
+
+Dependency-free (no tomlkit) so it also runs inside the flatpak build sandbox and on the
+Steam Deck's stock python.
+
+Usage: prune-windows-toml.py <Cargo.toml> [<Cargo.toml> ...]
+"""
+
+import sys
+
+WINDOWS_RS = "github.com/microsoft/windows-rs"
+
+
+def prune(text: str) -> tuple[str, int]:
+    lines = text.splitlines(keepends=True)
+    kept: list[str] = []
+    removed = 0
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        stripped = line.strip()
+        # A dependency entry opening an inline table that pins the windows-rs git repo.
+        # Single-line entries contain the URL and balance their braces on the same line;
+        # multi-line entries (features arrays) run until the braces balance again.
+        if "=" in stripped and "{" in stripped and not stripped.startswith("#"):
+            depth = stripped.count("{") - stripped.count("}")
+            entry = [line]
+            j = i + 1
+            while depth > 0 and j < len(lines):
+                s = lines[j]
+                depth += s.count("{") - s.count("}")
+                entry.append(s)
+                j += 1
+            if any(WINDOWS_RS in e for e in entry):
+                removed += 1
+                i = j
+                continue
+        kept.append(line)
+        i += 1
+    return "".join(kept), removed
+
+
+def main() -> None:
+    for path in sys.argv[1:]:
+        text = open(path).read()
+        out, removed = prune(text)
+        if removed == 0:
+            sys.exit(f"{path}: no windows-rs git entry found — already pruned, or the "
+                     "dependency moved (update this script's callers)")
+        open(path, "w").write(out)
+        print(f"{path}: removed {removed} windows-rs git dependenc{'y' if removed == 1 else 'ies'}")
+
+
+if __name__ == "__main__":
+    main()