feat(packaging/flatpak,decky): Steam Deck client flatpak + plugin deploy + CI

Ship the punktfunk Linux client to the Steam Deck as a Flatpak — the only viable
SteamOS install path, since /usr is read-only and lacks libadwaita/SDL3 — and
publish both it and the Decky plugin through Gitea. Built and validated live on a
Steam Deck (SteamOS 3.7): bundle installs user-scope, all libs resolve, libavcodec
resolves to the codecs-extra HEVC build, devices=all for DualSense hidraw.

packaging/flatpak (new):
- io.unom.Punktfunk.yml on GNOME 50 / freedesktop-sdk 25.08. rust-stable//25.08
  (rustc 1.96 — the GTK4 chain needs >=1.92; the EOL GNOME-48/24.08 rust-stable at
  1.89 could not build it) + llvm20 (libclang for bindgen in ffmpeg-sys-next/sdl3-sys).
  HEVC libavcodec comes from the runtime's auto codecs-extra extension point (no
  app-side codec declaration). Bundled SDL3 3.4.10 (matches sdl3-sys 0.6.6+SDL-3.4.10).
  finish-args: wayland/fallback-x11, --device=all (GPU/VAAPI + evdev + hidraw — flatpak
  cannot bind /dev/hidrawN char devices via --filesystem), pulseaudio, network,
  ~/.config/punktfunk.
- metainfo.xml, desktop, square SVG icon, build-flatpak.sh (offline cargo-sources;
  on-Deck org.flatpak.Builder or CI), README.

clients/decky:
- add LICENSE (MIT), fix package.json license (BSD-3-Clause -> Apache-2.0 OR MIT),
  add scripts/{package.sh,deploy.sh} (the plugins dir is root-owned: stage to /tmp,
  sudo install, restart plugin_loader), align the launcher fallback to the real
  flatpak app id io.unom.Punktfunk, rewrite the install section.

.gitea/workflows:
- flatpak.yml: privileged Fedora container builds the bundle and publishes to the
  Gitea generic registry (+ release attachment on tags).
- decky.yml: pnpm build -> store-layout zip -> registry (stable latest/ URL for
  Decky "install from URL").

docs: packaging/README + packaging/flatpak/README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/decky/scripts/package.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Assemble the Decky plugin into the canonical store/sideload layout:
+#
+#   out/punktfunk-v<version>.zip   ->  punktfunk/{dist/index.js,main.py,plugin.json,
+#                                                  package.json,decky.pyi,LICENSE,README.md}
+#   out/punktfunk/                 (the same tree, unzipped — rsync this with scripts/deploy.sh)
+#
+# Decky extracts the zip with --strip-components=1, so the single top-level dir MUST equal
+# plugin.json "name". Run after `pnpm build` (or use `pnpm run package`). Host-agnostic: needs
+# only bash, python3 and zip.
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$HERE"
+
+[ -f dist/index.js ] || { echo "dist/index.js missing — run 'pnpm build' first" >&2; exit 1; }
+[ -f LICENSE ]       || { echo "LICENSE missing (required by the Decky store)" >&2; exit 1; }
+
+NAME="$(python3 -c 'import json;print(json.load(open("plugin.json"))["name"])')"
+VER="$(python3 -c 'import json;print(json.load(open("package.json"))["version"])')"
+
+STAGE="$(mktemp -d)"
+DEST="$STAGE/$NAME"
+mkdir -p "$DEST/dist"
+cp dist/index.js "$DEST/dist/index.js"          # ship the bundle only, not the sourcemap
+cp main.py plugin.json package.json LICENSE "$DEST/"
+[ -f decky.pyi ]  && cp decky.pyi  "$DEST/"
+[ -f README.md ]  && cp README.md  "$DEST/"
+
+OUT="$HERE/out"
+mkdir -p "$OUT"
+ZIP="$OUT/${NAME}-v${VER}.zip"
+rm -f "$ZIP"
+( cd "$STAGE" && zip -r -X "$ZIP" "$NAME" >/dev/null )
+# Leave an unzipped staging tree for the rsync/sudo deploy path (scripts/deploy.sh).
+rm -rf "$OUT/$NAME" && cp -r "$DEST" "$OUT/$NAME"
+rm -rf "$STAGE"
+
+echo "built  $ZIP"
+echo "staged $OUT/$NAME  (deploy with: DECK=deck@<ip> bash scripts/deploy.sh)"