feat(ci): build and publish the Flatpak

One job replaces the tarball pipeline. On a pull request it builds the
Flatpak with flatpak-builder, which runs the bootstrap, the self-host
build and the test suite inside the sandbox, and smoke-tests the result
with `crafter-build --version` and the hello-world example. On a push to
master it also bundles the build, promotes it into the live repo as the
`beta` branch and refreshes the rolling `latest` prerelease. On a tag
X.Y.Z it promotes as `stable`, refuses to proceed unless the metainfo's
newest release is that version, and publishes a release whose notes are
that entry's description.

The job runs on the `flatpak` runner label: the privileged forgejo-runner
on the Hetzner box, with the Sdk install, the flatpak-builder state and
the repo's web root as volumes. The state volume is what keeps a normal
run short: flatpak-builder rebuilds the LLVM and WASI modules only when
their sources change. The live repo is canonical and never built into;
builds are promoted with build-commit-from, then build-update-repo signs
and prunes it and generates static deltas.

The musl job, the per-march tarballs, the toolchain packages the runner
used to install and the PKGBUILD go: the Flatpak is the one artifact.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

packaging/flatpak/net.catcrafts.CrafterBuild.yaml

@@ -46,14 +46,26 @@ modules:
     builddir: true
     subdir: llvm
     build-options:
-      # Debug info for all of LLVM would be a multi-gigabyte .Debug extension.
+      # flatpak-builder's default CFLAGS carry -g. For all of LLVM that is a
+      # 30 GB build tree and a multi-gigabyte .Debug extension, so build
+      # without debug info, strip, and skip the split. The hardening flags
+      # from the defaults stay.
       no-debuginfo: true
+      strip: true
+      cflags: -O2 -pipe -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protection
+      cflags-override: true
+      cxxflags: -O2 -pipe -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protection
+      cxxflags-override: true
     config-opts:
       - -DCMAKE_BUILD_TYPE=Release
       - -DLLVM_ENABLE_ASSERTIONS=OFF
       - -DLLVM_ENABLE_PROJECTS=clang;lld
       - -DLLVM_ENABLE_RUNTIMES=compiler-rt;libcxx;libcxxabi;libunwind
       - -DLLVM_TARGETS_TO_BUILD=X86;AArch64;WebAssembly
+      # Classic layout: libc++ in lib/ and include/c++/v1, not under a
+      # per-target subdirectory. It is what clang's own default search, the
+      # rpath crafter-build adds and distro installs all assume.
+      - -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF
       # One shared LLVM and one shared clang library instead of a statically
       # linked copy per tool: a fraction of the install size.
       - -DLLVM_BUILD_LLVM_DYLIB=ON
@@ -115,6 +127,16 @@ modules:
     builddir: true
     build-options:
       no-debuginfo: true
+      # flatpak-builder's default CFLAGS/LDFLAGS are x86-64 hardening flags
+      # (-fcf-protection, -z relro) that the nested wasm32 builds inherit
+      # through the environment and clang rejects for that target.
+      cflags: ""
+      cflags-override: true
+      cxxflags: ""
+      cxxflags-override: true
+      ldflags: ""
+      ldflags-override: true
+      strip: true
     config-opts:
       - -DCMAKE_TOOLCHAIN_FILE=/run/build/wasi-sysroot/wasi-host-toolchain.cmake
       - -DWASI_SDK_BUILD_TOOLCHAIN=OFF