packaging, ci: build the apks with the Crafter.Build Flatpak

Crafter.Build's CI publishes a Flatpak and nothing else since
2026-10-02: the rolling `latest` release's
`crafter-build-linux-x86_64-musl-v2.tar.gz` that build-package.sh
fetched is gone (404 since 2026-10-03), so a push of a release would
fail at `fetch crafter-build` and publish nothing.

Install the Flatpak (`net.catcrafts.CrafterBuild//stable` from
flatpak.catcrafts.net) in the job container and run it as crafter-build.
bubblewrap inside the container needs a privileged runner, so the job
runs on the `flatpak` label. The sysroot stays Alpine edge and gains
llvm-runtimes, the package with the std module source of its own libc++
(libc++-dev ships none). make-sysroot.sh adds its list with --upgrade:
run over a sysroot from before this change (libc++ 22.1.8, no std module
source) a plain add installed llvm-runtimes 23.1.2 alone, and its
std.cppm did not compile against the 22.1.8 headers (`'text_encoding'
file not found`); with --upgrade libc++, libc++-dev and llvm-runtimes
came out at 23.1.2 and it compiled.

AGENTS.md §4.1, §4.3, §8.3 and §9.4 describe the route as it runs, and
the README's Building section carries the install lines. Three comments
in the files this touches said what is not so and are corrected:
package.yml had fp6-img install the package by a pinned version and
sha256 (it takes the newest in the registry), build-package.sh had
fp6-img's image build run `make check` on the aarch64 binaries (it
builds no imsd: no suite runs on them), and make-sysroot.sh's usage line
lacked the --march without which the cross build fails on an x86 host.

Tested: build-package.sh run end to end on this commit in a privileged
alpine:edge container (podman) on the workstation.

README.md

@@ -42,11 +42,11 @@ your carrier's P-CSCF address.
 
 On a Catcrafts Fairphone 6 image imsd is installed from the project's apk
 registry and upgrades with `apk upgrade` (an upgrade restarts the daemon; a
-call in progress ends). Elsewhere, build it (below), `make install`, and
-enable the units yourself — `systemctl enable imsd`, and `systemctl enable
---now imsd-ofonod` for GNOME Calls: imsd's preset, the
-`multi-user.target.wants` link and the `/etc/imsd.env` condition below come
-with the apk, not with `make install`.
+call in progress ends). Elsewhere, build it with `make` (below), run
+`make install`, and enable the units yourself — `systemctl enable imsd`,
+and `systemctl enable --now imsd-ofonod` for GNOME Calls: imsd's preset,
+the `multi-user.target.wants` link and the `/etc/imsd.env` condition
+below come with the apk, not with `make install`.
 
 Configuration is environment variables in `/etc/imsd.env`; the one required
 setting is the P-CSCF:
@@ -102,13 +102,23 @@ session and root may place, answer and end calls; an ssh login may not.
 
 ## Building
 
-[Crafter Build](https://forgejo.catcrafts.net/Catcrafts/Crafter.Build) plus
-clang/libc++/lld and the gio-2.0 headers:
+With the [Crafter Build](https://forgejo.catcrafts.net/Catcrafts/Crafter.Build)
+Flatpak, which carries the compiler:
 
 ```sh
+flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+flatpak remote-add --if-not-exists catcrafts https://flatpak.catcrafts.net/catcrafts.flatpakrepo
+flatpak install catcrafts net.catcrafts.CrafterBuild//stable
+alias crafter-build='flatpak run net.catcrafts.CrafterBuild//stable'
 crafter-build          # the daemon; -- --product=media|dialerd|ofonod for the others
 crafter-build test     # the seven unit-test suites
-make && make check     # the same, without crafter-build (distro packaging)
+```
+
+Or without crafter-build (distro packaging), with clang/libc++/lld and the
+gio-2.0 headers:
+
+```sh
+make && make check
 ```
 
 Cross-compiling for a phone, the Makefile's requirements, the package layout