Revert flatpak to building from source; add appstream package

Reusing the linux job's binary (previous commit) doesn't work: it's
dynamically linked against ~100 libraries at absolute /nix/store
paths, including its own ELF interpreter, none of which exist inside
the Flatpak sandbox - confirmed locally via a real install+run
(execvp: No such file or directory). Reverted to building from source
inside flatpak-builder's sandbox via the rust-stable SDK extension,
same as the existing local `devbox run package` already does.

Also fixes two things needed for that in-sandbox build to work under
the forgejo-runner service (not an interactive session):
- appstreamcli (used by flatpak-builder to compose AppStream metadata)
  wasn't on PATH - added as a devbox package (linux-only, like
  gtk4/libadwaita) rather than a NixOS system package, keeping it
  scoped to the project.
- rofiles-fuse's mount/unmount cycle fails under the service context
  even though /dev/fuse itself is world-writable; --disable-rofiles-fuse
  is flatpak-builder's own documented workaround for this.

Verified locally: full build, appstreamcli compose, bundle install,
and the installed binary actually executing inside the sandbox.

.forgejo/workflows/release.yml

@@ -103,26 +103,24 @@ jobs:
           name: carrier-linux-x86_64
           path: carrier/target/release/carrier-linux-x86_64
 
-  # Packages the linux job's already-built binary instead of recompiling
-  # inside flatpak-builder's own sandbox: that sandbox copies the source
-  # tree in fresh, so it never sees ~/.cargo/registry or target/, making an
-  # in-sandbox cargo build fully redundant with the linux job's build.
-  # com.randogoth.carrier.release.json (not the main manifest, which is
-  # still used by local `devbox run package` for from-source dev builds)
-  # just installs this prebuilt binary instead of invoking cargo.
+  # Builds from source inside flatpak-builder's own sandbox, via the
+  # rust-stable SDK extension (same as com.randogoth.carrier.json already
+  # does for local `devbox run package`). Reusing the linux job's binary
+  # was tried and reverted: that binary is dynamically linked against ~100
+  # libraries at absolute /nix/store paths, including its own ELF
+  # interpreter - none of which exist inside the Flatpak sandbox, so it
+  # can never execute there regardless of how it's packaged in.
   flatpak:
-    needs: [linux]
     runs-on: linux-x86_64
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
         with:
           path: carrier
-      - uses: https://code.forgejo.org/forgejo/download-artifact@v7
+      - uses: https://code.forgejo.org/actions/checkout@v4
         with:
-          name: carrier-linux-x86_64
-          path: carrier
-      - run: chmod +x carrier-linux-x86_64
-        working-directory: carrier
+          repository: randogoth/fumi
+          ref: main
+          path: fumi
       - run: devbox run bundle-flatpak
         working-directory: carrier
         env: