packaging, ci: build the apk with the Crafter.Build Flatpak

Crafter.Build's releases carry a Flatpak and nothing else since
2026-10-02 (imsd a625248): the rolling `latest` release's
crafter-build-linux-x86_64-musl-v2.tar.gz that build-package.sh fetched
is gone, so the push of 0.2.6 failed at `fetch crafter-build` (run 10,
2026-10-14, three 404s) and published nothing; the registry still
serves 0.2.5.

The move imsd made on 2026-10-04: install the Flatpak
(net.catcrafts.CrafterBuild//stable from flatpak.catcrafts.net) in the
job container and run it as crafter-build. bubblewrap inside the
container needs a privileged runner, so the job runs on the `flatpak`
label. The host keeps clang and llvm-ar for libqcomtee, which
make-libqcomtee.sh compiles against the sysroot; the daemon's compiler,
lld and libc++ are the Flatpak's, so the host packages that served the
native test-suite run go. The sysroot gains llvm-runtimes, the package
with the std module source of its own libc++ (libc++-dev ships none),
added with --upgrade so a sysroot from before this change comes out
with a matching libc++ and source. The README's Build section carries
the install lines.

Tested: build-package.sh run end to end on this commit in a privileged
alpine:edge container (podman) on the workstation: crafter-build 2.1.0
(clang 23.1.2) from `stable`, the sysroot at libc++ and llvm-runtimes
23.1.3, daemon and agent cross-built, 8 suites passed natively, the
three apks built, the daemon an aarch64 PIE against the sysroot's musl
and libc++ (65 s). The rehearsed copy differs from this commit by the
wrapping of one comment line.

packaging/make-sysroot.sh

@@ -23,9 +23,14 @@ MIRROR="${MIRROR:-https://dl-cdn.alpinelinux.org/alpine/edge}"
 ARCH=aarch64
 # gcc is in the list for its crtbeginS.o/libgcc: clang's driver for
 # *-alpine-linux-musl links against the GCC runtime it detects under
-# <sysroot>/usr/lib/gcc/<triple>/.
+# <sysroot>/usr/lib/gcc/<triple>/. llvm-runtimes is in it for the std module
+# source of this very libc++ (usr/share/libc++/v1/std.cppm; libc++-dev ships
+# none): crafter-build compiles the sysroot's own copy first. --upgrade below
+# is for a run over an existing sysroot: added alone beside an older libc++,
+# a newer llvm-runtimes' source does not compile against its headers
+# (imsd, 2026-10-04: 23.1.2 against 22.1.8); upgraded together, it does.
 # glib-dev is for the GDBus bus layer (net.reactivated.Fprint).
-PKGS="musl-dev libc++ libc++-dev glib-dev compiler-rt llvm-libunwind-dev gcc"
+PKGS="musl-dev libc++ libc++-dev llvm-runtimes glib-dev compiler-rt llvm-libunwind-dev gcc"
 
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT
@@ -48,6 +53,6 @@ mkdir -p "$SYSROOT"
     --arch "$ARCH" --root "$SYSROOT" --initdb --no-scripts --no-cache \
     --usermode --keys-dir "$work/usr/share/apk/keys/$ARCH" \
     -X "$MIRROR/main" -X "$MIRROR/community" \
-    add $PKGS
+    add --upgrade $PKGS
 
 echo ">> done: $SYSROOT"