build(flatpak): make the manifest architecture-generic

Two things were x86-specific, both now expressed properly instead of
hardcoded:

  * PKG_CONFIG_PATH carries the runtime's multiarch directory.
    flatpak-builder does NOT shell-expand `env` values, so ${FLATPAK_ARCH}
    would be taken literally — a build-options.arch override supplies the
    aarch64 string and inherits the rest.

  * The prebuilt Skia archive is per-target and pinned by sha256. Two
    `type: file` sources discriminated by only-arches now share one
    dest-filename, so SKIA_BINARIES_URL stays a single literal path.
    Upstream publishes the aarch64 archive under the same skia commit hash
    and the same resolved-feature key, so the two stay in lockstep on a
    skia-safe bump.

build-flatpak.sh gains ARCH (default: this machine's), passes --arch to
both flatpak-builder and build-bundle, and arch-suffixes the bundle name so
an x86_64 and an aarch64 build can coexist in dist/ instead of the second
silently overwriting the first. CI composes its own published filename, so
nothing downstream changes.

The aarch64 Skia sha256 was verified by downloading the published archive,
not taken from the API. No aarch64 flatpak has been built — flatpak-builder
builds in a sandbox for the target arch, which needs an arm64 machine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packaging/flatpak/build-flatpak.sh

@@ -16,6 +16,12 @@
 #                      iteration, non-reproducible). Default: offline (regenerates cargo-sources).
 #   BUILDER=...        override the flatpak-builder invocation (default: auto-detect host
 #                      flatpak-builder, else `flatpak run org.flatpak.Builder`).
+#   ARCH=...           target architecture (default: this machine's). `aarch64` builds the arm64
+#                      client — the manifest carries the per-arch PKG_CONFIG_PATH and the matching
+#                      prebuilt Skia archive. NOTE this is not a cross-compile: flatpak-builder
+#                      runs the build inside a sandbox for that arch, so building aarch64 on an
+#                      x86_64 box needs qemu binfmt registered and is very slow. Run it on an
+#                      arm64 machine.
 set -euo pipefail
 
 ROOTDIR="$(cd "$(dirname "$0")/../.." && pwd)"
@@ -25,7 +31,11 @@ APP_ID="io.unom.Punktfunk"
 MANIFEST="packaging/flatpak/io.unom.Punktfunk.yml"
 VERSION="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo 0.0.1-dev)}"
 VERSION="${VERSION#v}"
-BUNDLE="dist/punktfunk-client-${VERSION}.flatpak"
+# `flatpak --default-arch` reports flatpak's own name for this machine (x86_64 / aarch64).
+ARCH="${ARCH:-$(flatpak --default-arch 2>/dev/null || uname -m)}"
+# Arch-suffixed so an x86_64 and an aarch64 bundle can sit in dist/ together instead of the
+# second silently overwriting the first. (CI composes its own published filename.)
+BUNDLE="dist/punktfunk-client-${VERSION}-${ARCH}.flatpak"
 
 # --- pick a flatpak-builder (host binary, or the org.flatpak.Builder flatpak on the Deck) ---
 if [ -n "${BUILDER:-}" ]; then
@@ -72,18 +82,19 @@ else
 fi
 
 # --- build into a local ostree repo, then export a single-file bundle --------------------
-echo "==> flatpak-builder ($APP_ID, version $VERSION)"
+echo "==> flatpak-builder ($APP_ID, version $VERSION, arch $ARCH)"
 # --default-branch=stable matches CI / the hosted repo ref, so a locally-built install can also
 # track flatpak.unom.io. build-bundle must then be told the branch (else it defaults to `master`).
 "${FPB[@]}" --user --force-clean --disable-rofiles-fuse \
   --default-branch=stable \
+  --arch="$ARCH" \
   --install-deps-from=flathub \
   "${EXTRA_ARGS[@]}" \
   --repo="$ROOTDIR/.flatpak-repo" \
   "$ROOTDIR/.flatpak-build" "$MANIFEST"
 
 mkdir -p dist
-flatpak build-bundle "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
+flatpak build-bundle --arch="$ARCH" "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
 echo "built $BUNDLE"
 ls -lh "$BUNDLE"
 echo