packaging, ci: build the apk with the Crafter.Build Flatpak

Crafter.Build's releases carry a Flatpak and nothing else since
2026-10-02 (imsd a625248): the rolling `latest` release's
crafter-build-linux-x86_64-musl-v2.tar.gz that build-package.sh fetched
is gone, so the push of 0.2.6 failed at `fetch crafter-build` (run 10,
2026-10-14, three 404s) and published nothing; the registry still
serves 0.2.5.

The move imsd made on 2026-10-04: install the Flatpak
(net.catcrafts.CrafterBuild//stable from flatpak.catcrafts.net) in the
job container and run it as crafter-build. bubblewrap inside the
container needs a privileged runner, so the job runs on the `flatpak`
label. The host keeps clang and llvm-ar for libqcomtee, which
make-libqcomtee.sh compiles against the sysroot; the daemon's compiler,
lld and libc++ are the Flatpak's, so the host packages that served the
native test-suite run go. The sysroot gains llvm-runtimes, the package
with the std module source of its own libc++ (libc++-dev ships none),
added with --upgrade so a sysroot from before this change comes out
with a matching libc++ and source. The README's Build section carries
the install lines.

Tested: build-package.sh run end to end on this commit in a privileged
alpine:edge container (podman) on the workstation: crafter-build 2.1.0
(clang 23.1.2) from `stable`, the sysroot at libc++ and llvm-runtimes
23.1.3, daemon and agent cross-built, 8 suites passed natively, the
three apks built, the daemon an aarch64 PIE against the sysroot's musl
and libc++ (65 s). The rehearsed copy differs from this commit by the
wrapping of one comment line.

.forgejo/workflows/package.yml

@@ -7,9 +7,10 @@ name: package
 #
 # Build: crafter-build cross-compiles against an Alpine aarch64 sysroot
 # (packaging/build-package.sh — the README's "Cross-compiling" flow), the test
-# suite runs natively, and packaging/APKBUILD wraps the result. This needs no
-# privileged runner: it runs in an alpine:edge container on the ordinary
-# arch-latest runner.
+# suite runs natively, and packaging/APKBUILD wraps the result. crafter-build
+# is the Crafter.Build Flatpak, and bubblewrap inside the job container needs
+# a privileged runner: the job runs on the `flatpak` label (the Catcrafts
+# organisation's privileged runner), in an alpine:edge container.
 #
 # Release gating is the version: pkgver comes from interfaces/Fingerprintd.cppm,
 # the registry answers 409 for an already-published version, and the publish
@@ -27,7 +28,7 @@ on:
 
 jobs:
   package:
-    runs-on: arch-latest
+    runs-on: flatpak
     container:
       image: alpine:edge
     timeout-minutes: 90