fix(flatpak): prune microsoft/windows-rs git crates before vendoring

The flatpak CI was failing at "Downloading sources" with "No space left
on device": flatpak-cargo-generator walks the whole workspace Cargo.lock
and emits a `type: git` source for the windows-rs crates (windows +
windows-reactor + ~12 sub-crates, pinned by punktfunk-client-windows),
and flatpak-builder then FULL-clones that multi-GB repo — for a bundle
that only ever compiles `-p punktfunk-client-linux` and never touches a
windows-* crate.

New packaging/flatpak/prune-windows-lock.py writes a copy of Cargo.lock
with the windows-rs git packages stripped (matches on the `source =`
line, so a crate that merely lists a windows dependency is kept;
dependency-free so it also runs on the Deck's stock python). Both the CI
and build-flatpak.sh feed that pruned lock to the generator. The
committed Cargo.lock is untouched — cargo --offline only needs vendored
sources for the crates it actually builds, and the windows-rs crates are
not in the Linux client's dependency closure.

Verified locally: 14 crates pruned (507 -> 493 packages), zero windows-rs
`source =` lines remain, output parses as TOML, all Linux-client deps
(gtk4/ffmpeg-sys-next/sdl3/pipewire) intact.

This unblocks the flatpak build carrying the VAAPI green-screen fix
(64b1679) for the Steam Deck.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/flatpak/build-flatpak.sh

@@ -65,7 +65,10 @@ else
   fi
   # Needs python3 + aiohttp + tomlkit. On a host that lacks them (e.g. the Deck), generate on the
   # Mac / a dev box instead and rsync the result next to the manifest (reused by the branch above).
-  python3 "$GEN" Cargo.lock -o packaging/flatpak/cargo-sources.json
+  # Prune the microsoft/windows-rs git crates first (punktfunk-client-windows only) — otherwise
+  # flatpak-builder full-clones that multi-GB repo and fills the disk. See prune-windows-lock.py.
+  python3 packaging/flatpak/prune-windows-lock.py Cargo.lock /tmp/Cargo.flatpak.lock
+  python3 "$GEN" /tmp/Cargo.flatpak.lock -o packaging/flatpak/cargo-sources.json
 fi
 
 # --- build into a local ostree repo, then export a single-file bundle --------------------

packaging/flatpak/prune-windows-lock.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Write a copy of a Cargo.lock with the microsoft/windows-rs git packages removed.
+
+The punktfunk workspace lockfile includes `punktfunk-client-windows`' git dependencies — the
+whole microsoft/windows-rs tree (windows-reactor + ~13 `windows-*` crates, all pinned to one
+git rev). The flatpak builds ONLY the Linux client (`-p punktfunk-client-linux`), which never
+references them, but `flatpak-cargo-generator.py` walks the whole lock and emits a `type: git`
+source for windows-rs; `flatpak-builder` then FULL-clones that multi-GB repo at "Downloading
+sources" → "No space left on device", failing the build.
+
+Stripping those packages from the lock the generator sees is safe: the committed Cargo.lock is
+left untouched for the `--locked` build, and `cargo --offline` only needs vendored sources for
+the crates it actually compiles (none of the windows-rs crates are in the Linux client's
+dependency closure).
+
+Dependency-free (no tomlkit) so it also runs on the Steam Deck's stock python. Matches on the
+`source =` line specifically, so a crate that merely *lists* a windows-rs dependency is kept.
+
+Usage: prune-windows-lock.py <in Cargo.lock> <out lock>
+"""
+import sys
+
+WINDOWS_RS = "github.com/microsoft/windows-rs"
+
+
+def is_windows_rs(block: str) -> bool:
+    for line in block.splitlines():
+        s = line.strip()
+        if s.startswith("source = ") and WINDOWS_RS in s:
+            return True
+    return False
+
+
+def main() -> None:
+    src, dst = sys.argv[1], sys.argv[2]
+    text = open(src).read()
+    # Cargo.lock (v3+) is a header followed by `[[package]]` blocks, no trailing [metadata].
+    parts = text.split("\n[[package]]\n")
+    header = parts[0]
+    kept, removed = [], 0
+    for block in parts[1:]:
+        if is_windows_rs(block):
+            removed += 1
+        else:
+            kept.append(block)
+    out = header + "".join("\n[[package]]\n" + b for b in kept)
+    open(dst, "w").write(out)
+    print(f"prune-windows-lock: removed {removed} windows-rs git crates ({src} -> {dst})")
+
+
+if __name__ == "__main__":
+    main()