feat(packaging/flatpak,decky): Steam Deck client flatpak + plugin deploy + CI

Ship the punktfunk Linux client to the Steam Deck as a Flatpak — the only viable
SteamOS install path, since /usr is read-only and lacks libadwaita/SDL3 — and
publish both it and the Decky plugin through Gitea. Built and validated live on a
Steam Deck (SteamOS 3.7): bundle installs user-scope, all libs resolve, libavcodec
resolves to the codecs-extra HEVC build, devices=all for DualSense hidraw.

packaging/flatpak (new):
- io.unom.Punktfunk.yml on GNOME 50 / freedesktop-sdk 25.08. rust-stable//25.08
  (rustc 1.96 — the GTK4 chain needs >=1.92; the EOL GNOME-48/24.08 rust-stable at
  1.89 could not build it) + llvm20 (libclang for bindgen in ffmpeg-sys-next/sdl3-sys).
  HEVC libavcodec comes from the runtime's auto codecs-extra extension point (no
  app-side codec declaration). Bundled SDL3 3.4.10 (matches sdl3-sys 0.6.6+SDL-3.4.10).
  finish-args: wayland/fallback-x11, --device=all (GPU/VAAPI + evdev + hidraw — flatpak
  cannot bind /dev/hidrawN char devices via --filesystem), pulseaudio, network,
  ~/.config/punktfunk.
- metainfo.xml, desktop, square SVG icon, build-flatpak.sh (offline cargo-sources;
  on-Deck org.flatpak.Builder or CI), README.

clients/decky:
- add LICENSE (MIT), fix package.json license (BSD-3-Clause -> Apache-2.0 OR MIT),
  add scripts/{package.sh,deploy.sh} (the plugins dir is root-owned: stage to /tmp,
  sudo install, restart plugin_loader), align the launcher fallback to the real
  flatpak app id io.unom.Punktfunk, rewrite the install section.

.gitea/workflows:
- flatpak.yml: privileged Fedora container builds the bundle and publishes to the
  Gitea generic registry (+ release attachment on tags).
- decky.yml: pnpm build -> store-layout zip -> registry (stable latest/ URL for
  Decky "install from URL").

docs: packaging/README + packaging/flatpak/README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/decky/scripts/deploy.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Deploy the staged plugin tree (out/<name>, produced by scripts/package.sh) into a Steam
+# Deck's ~/homebrew/plugins/, then restart Decky Loader.
+#
+# Decky's plugins dir is ROOT-OWNED (PluginLoader runs as root and manages it), so the install
+# step needs sudo on the Deck. We rsync to a deck-writable /tmp first (no privilege), then
+# sudo-copy into place. Out-of-band installs only appear after a loader restart.
+#
+# Usage:
+#   DECK=deck@192.168.1.235 bash scripts/deploy.sh             # interactive sudo (prompts on the Deck)
+#   DECK=deck@192.168.1.235 DECKPASS=... bash scripts/deploy.sh # non-interactive (scripted/CI)
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+DECK="${DECK:?set DECK=deck@<ip>}"
+NAME="$(python3 -c 'import json;print(json.load(open("'"$HERE"'/plugin.json"))["name"])')"
+STAGE_LOCAL="$HERE/out/$NAME"
+[ -d "$STAGE_LOCAL" ] || { echo "$STAGE_LOCAL missing — run scripts/package.sh first" >&2; exit 1; }
+
+# 1. push to a deck-writable temp dir (deck owns its $HOME)
+rsync -azp --delete -e ssh "$STAGE_LOCAL/" "$DECK:/tmp/$NAME/"
+
+# 2. sudo-install into the root-owned plugins dir, match Decky's root:root ownership, reload
+INSTALL="rm -rf /home/deck/homebrew/plugins/$NAME \
+  && cp -r /tmp/$NAME /home/deck/homebrew/plugins/$NAME \
+  && chown -R root:root /home/deck/homebrew/plugins/$NAME \
+  && rm -rf /tmp/$NAME \
+  && systemctl restart plugin_loader"
+
+if [ -n "${DECKPASS:-}" ]; then
+  ssh "$DECK" "echo '$DECKPASS' | sudo -S sh -c '$INSTALL'"
+else
+  echo "==> sudo on the Deck will prompt for ${DECK}'s password:"
+  ssh -t "$DECK" "sudo sh -c '$INSTALL'"
+fi
+echo "deployed $NAME → $DECK:~/homebrew/plugins/$NAME and restarted plugin_loader"