packaging, ci: build the apks with the Crafter.Build Flatpak

Crafter.Build's CI publishes a Flatpak and nothing else since
2026-10-02: the rolling `latest` release's
`crafter-build-linux-x86_64-musl-v2.tar.gz` that build-package.sh
fetched is gone (404 since 2026-10-03), so a push of a release would
fail at `fetch crafter-build` and publish nothing.

Install the Flatpak (`net.catcrafts.CrafterBuild//stable` from
flatpak.catcrafts.net) in the job container and run it as crafter-build.
bubblewrap inside the container needs a privileged runner, so the job
runs on the `flatpak` label. The sysroot stays Alpine edge and gains
llvm-runtimes, the package with the std module source of its own libc++
(libc++-dev ships none). make-sysroot.sh adds its list with --upgrade:
run over a sysroot from before this change (libc++ 22.1.8, no std module
source) a plain add installed llvm-runtimes 23.1.2 alone, and its
std.cppm did not compile against the 22.1.8 headers (`'text_encoding'
file not found`); with --upgrade libc++, libc++-dev and llvm-runtimes
came out at 23.1.2 and it compiled.

AGENTS.md §4.1, §4.3, §8.3 and §9.4 describe the route as it runs, and
the README's Building section carries the install lines. Three comments
in the files this touches said what is not so and are corrected:
package.yml had fp6-img install the package by a pinned version and
sha256 (it takes the newest in the registry), build-package.sh had
fp6-img's image build run `make check` on the aarch64 binaries (it
builds no imsd: no suite runs on them), and make-sysroot.sh's usage line
lacked the --march without which the cross build fails on an x86 host.

Tested: build-package.sh run end to end on this commit in a privileged
alpine:edge container (podman) on the workstation.

packaging/make-sysroot.sh

@@ -8,7 +8,8 @@
 # clang can use via --sysroot. No root, no qemu, no device needed:
 #
 #   packaging/make-sysroot.sh [dir]        # default: ~/.cache/imsd/sysroot-aarch64-alpine
-#   crafter-build --target=aarch64-alpine-linux-musl --sysroot=<dir>
+#   crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=<dir> \
+#       --march=… --mtune=…                # the phone's values: AGENTS.md §4.3
 set -eu
 
 SYSROOT="${1:-$HOME/.cache/imsd/sysroot-aarch64-alpine}"
@@ -16,8 +17,13 @@ MIRROR="${MIRROR:-https://dl-cdn.alpinelinux.org/alpine/edge}"
 ARCH=aarch64
 # gcc is in the list for its crtbeginS.o/libgcc: clang's driver for
 # *-alpine-linux-musl links against the GCC runtime it detects under
-# <sysroot>/usr/lib/gcc/<triple>/
-PKGS="musl-dev libc++ libc++-dev glib-dev compiler-rt llvm-libunwind-dev gcc"
+# <sysroot>/usr/lib/gcc/<triple>/. llvm-runtimes is in it for the std module
+# source of this very libc++ (usr/share/libc++/v1/std.cppm; libc++-dev ships
+# none): crafter-build compiles the sysroot's own copy first. --upgrade below
+# is for a run over an existing sysroot: added alone beside libc++ 22,
+# llvm-runtimes 23's source did not compile against its headers; upgraded
+# with it, it did.
+PKGS="musl-dev libc++ libc++-dev llvm-runtimes glib-dev compiler-rt llvm-libunwind-dev gcc"
 
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT
@@ -40,6 +46,6 @@ mkdir -p "$SYSROOT"
     --arch "$ARCH" --root "$SYSROOT" --initdb --no-scripts --no-cache \
     --usermode --keys-dir "$work/usr/share/apk/keys/$ARCH" \
     -X "$MIRROR/main" -X "$MIRROR/community" \
-    add $PKGS
+    add --upgrade $PKGS
 
 echo ">> done: $SYSROOT"