fix(flatpak): ship punktfunk-session so Decky streaming survives the two-binary split

The re-architected Linux client is now two binaries: the punktfunk-client shell
execs its sibling punktfunk-session (ash/Vulkan presenter + Skia console UI) for
--connect/--browse. The Decky plugin's stream and browse paths launch the shell
with exactly those flags, but the flatpak built and installed only the shell, so
streaming and the gamepad library from the Deck failed at exec with
"punktfunk-session: No such file" (pair/wake/library still worked — the shell
handles them in-process).

Build and install both binaries. The session binary pulls in Skia (skia-safe),
whose build script downloads a prebuilt libskia — dead in the offline sandbox —
so point skia-bindings at a pinned, vendored archive via SKIA_BINARIES_URL=file://
(read directly, no curl); the tarball rides along as a sha256-pinned flatpak
source. Widen the flatpak CI path filters to the session binary's crates
(linux-session, pf-presenter, pf-console-ui, pf-client-core) and fix the moved
library.rs path in the Decky error-classifier comment.

All other plugin↔client contracts (flags, pairing/library output, config files,
env vars, exit codes, the 47990 mgmt port) already match — no changes needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/flatpak/README.md

@@ -1,6 +1,8 @@
 # punktfunk client — Flatpak (Steam Deck / SteamOS, and any flatpak distro)
 
-The native Linux **client** (crate `punktfunk-client-linux`, binary `punktfunk-client`) is
+The native Linux **client** — the shell (crate `punktfunk-client-linux`, binary
+`punktfunk-client`) plus the Vulkan session binary it execs for streaming (crate
+`punktfunk-client-session`, binary `punktfunk-session`) — is
 published two ways by CI (`.gitea/workflows/flatpak.yml`), on every push to `main` (a rolling
 `0.0.1-ciN.<sha>` build) and on `v*` tags (a clean `X.Y.Z`):