packaging, ci: build the apks with the Crafter.Build Flatpak

Crafter.Build's CI publishes a Flatpak and nothing else since
2026-10-02: the rolling `latest` release's
`crafter-build-linux-x86_64-musl-v2.tar.gz` that build-package.sh
fetched is gone (404 since 2026-10-03), so a push of a release would
fail at `fetch crafter-build` and publish nothing.

Install the Flatpak (`net.catcrafts.CrafterBuild//stable` from
flatpak.catcrafts.net) in the job container and run it as crafter-build.
bubblewrap inside the container needs a privileged runner, so the job
runs on the `flatpak` label. The sysroot stays Alpine edge and gains
llvm-runtimes, the package with the std module source of its own libc++
(libc++-dev ships none). make-sysroot.sh adds its list with --upgrade:
run over a sysroot from before this change (libc++ 22.1.8, no std module
source) a plain add installed llvm-runtimes 23.1.2 alone, and its
std.cppm did not compile against the 22.1.8 headers (`'text_encoding'
file not found`); with --upgrade libc++, libc++-dev and llvm-runtimes
came out at 23.1.2 and it compiled.

AGENTS.md §4.1, §4.3, §8.3 and §9.4 describe the route as it runs, and
the README's Building section carries the install lines. Three comments
in the files this touches said what is not so and are corrected:
package.yml had fp6-img install the package by a pinned version and
sha256 (it takes the newest in the registry), build-package.sh had
fp6-img's image build run `make check` on the aarch64 binaries (it
builds no imsd: no suite runs on them), and make-sysroot.sh's usage line
lacked the --march without which the cross build fails on an x86 host.

Tested: build-package.sh run end to end on this commit in a privileged
alpine:edge container (podman) on the workstation.

.forgejo/workflows/package.yml

@@ -8,16 +8,17 @@ name: package
 # Build: crafter-build cross-compiles against an Alpine aarch64 sysroot
 # (packaging/build-package.sh — AGENTS.md §4.3's cross-compiling flow), the
 # test suite runs natively, and packaging/APKBUILD.binary wraps the result.
-# This needs no privileged runner: it runs in an alpine:edge container on
-# the ordinary arch-latest runner.
+# crafter-build is the Crafter.Build Flatpak, and bubblewrap inside the job
+# container needs a privileged runner: the job runs on the `flatpak` label
+# (a privileged runner registered to this repository), in an alpine:edge
+# container.
 #
 # Release gating is the version: pkgver comes from implementations/main.cpp,
 # the registry answers 409 for an already-published version, and the publish
 # step treats that as "nothing to do" — so pushes only release when the
 # Version constant bumps. This is the only producer of the imsd apk: fp6-img
-# images install the published package from the registry (pinned version,
-# pinned sha256) instead of building their own, so image and 'apk upgrade'
-# carry the same binary.
+# images install the published package from the registry instead of
+# building their own, so image and 'apk upgrade' carry the same binary.
 #
 # Publishing needs PACKAGE_TOKEN (catbot account, package:write scope) — an
 # org-level secret on Catcrafts since 2026-09-02, shared with fp6-img;
@@ -30,7 +31,7 @@ on:
 
 jobs:
   package:
-    runs-on: arch-latest
+    runs-on: flatpak
     container:
       image: alpine:edge
     timeout-minutes: 90