feat(packaging/flatpak,decky): Steam Deck client flatpak + plugin deploy + CI

Ship the punktfunk Linux client to the Steam Deck as a Flatpak — the only viable
SteamOS install path, since /usr is read-only and lacks libadwaita/SDL3 — and
publish both it and the Decky plugin through Gitea. Built and validated live on a
Steam Deck (SteamOS 3.7): bundle installs user-scope, all libs resolve, libavcodec
resolves to the codecs-extra HEVC build, devices=all for DualSense hidraw.

packaging/flatpak (new):
- io.unom.Punktfunk.yml on GNOME 50 / freedesktop-sdk 25.08. rust-stable//25.08
  (rustc 1.96 — the GTK4 chain needs >=1.92; the EOL GNOME-48/24.08 rust-stable at
  1.89 could not build it) + llvm20 (libclang for bindgen in ffmpeg-sys-next/sdl3-sys).
  HEVC libavcodec comes from the runtime's auto codecs-extra extension point (no
  app-side codec declaration). Bundled SDL3 3.4.10 (matches sdl3-sys 0.6.6+SDL-3.4.10).
  finish-args: wayland/fallback-x11, --device=all (GPU/VAAPI + evdev + hidraw — flatpak
  cannot bind /dev/hidrawN char devices via --filesystem), pulseaudio, network,
  ~/.config/punktfunk.
- metainfo.xml, desktop, square SVG icon, build-flatpak.sh (offline cargo-sources;
  on-Deck org.flatpak.Builder or CI), README.

clients/decky:
- add LICENSE (MIT), fix package.json license (BSD-3-Clause -> Apache-2.0 OR MIT),
  add scripts/{package.sh,deploy.sh} (the plugins dir is root-owned: stage to /tmp,
  sudo install, restart plugin_loader), align the launcher fallback to the real
  flatpak app id io.unom.Punktfunk, rewrite the install section.

.gitea/workflows:
- flatpak.yml: privileged Fedora container builds the bundle and publishes to the
  Gitea generic registry (+ release attachment on tags).
- decky.yml: pnpm build -> store-layout zip -> registry (stable latest/ URL for
  Decky "install from URL").

docs: packaging/README + packaging/flatpak/README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/decky/main.py

@@ -28,8 +28,9 @@ import decky
 # name and let the spawn fail loudly — install the client on the Deck (.deb / RPM / flatpak)
 # or symlink it into ~/.local/bin.
 #
-# TODO: once a Steam Deck / SteamOS install path for punktfunk-client is settled (likely a
-# flatpak, since SteamOS is image-based and /usr is read-only), pin the canonical path here.
+# On SteamOS (read-only /usr, image-based) the settled install path is the flatpak
+# ``io.unom.Punktfunk`` (packaging/flatpak/), launched via ``flatpak run`` — see the flatpak
+# fallback in :func:`_resolve_client`.
 CLIENT_BINARY = "punktfunk-client"
 
 # Service type advertised by punktfunk/1 hosts (matches NATIVE_SERVICE in the Rust host).
@@ -59,12 +60,14 @@ def _resolve_client() -> list[str]:
         if Path(candidate).exists():
             return [candidate]
 
-    # Flatpak fallback. The app id is a guess until a flatpak is actually published;
-    # `flatpak run <id>` is a no-op-ish failure if it is not installed, which surfaces as a
-    # spawn error the user can act on.
+    # Flatpak fallback — the canonical install path on the Steam Deck (SteamOS /usr is
+    # read-only; the flatpak bundles the libadwaita + SDL3 the system lacks). The app id is
+    # the one the flatpak manifest publishes (packaging/flatpak/io.unom.Punktfunk.yml). If it
+    # is not installed, `flatpak run <id>` fails and surfaces as a spawn error the user can
+    # act on (install the bundle: `flatpak install --user punktfunk-client-*.flatpak`).
     flatpak = shutil.which("flatpak")
     if flatpak:
-        return [flatpak, "run", "earth.buehler.punktfunk.Client"]
+        return [flatpak, "run", "io.unom.Punktfunk"]
 
     decky.logger.warning(
         "punktfunk-client not found on PATH or in %s; falling back to bare name",