Revert flatpak to building from source; add appstream package

Reusing the linux job's binary (previous commit) doesn't work: it's
dynamically linked against ~100 libraries at absolute /nix/store
paths, including its own ELF interpreter, none of which exist inside
the Flatpak sandbox - confirmed locally via a real install+run
(execvp: No such file or directory). Reverted to building from source
inside flatpak-builder's sandbox via the rust-stable SDK extension,
same as the existing local `devbox run package` already does.

Also fixes two things needed for that in-sandbox build to work under
the forgejo-runner service (not an interactive session):
- appstreamcli (used by flatpak-builder to compose AppStream metadata)
  wasn't on PATH - added as a devbox package (linux-only, like
  gtk4/libadwaita) rather than a NixOS system package, keeping it
  scoped to the project.
- rofiles-fuse's mount/unmount cycle fails under the service context
  even though /dev/fuse itself is world-writable; --disable-rofiles-fuse
  is flatpak-builder's own documented workaround for this.

Verified locally: full build, appstreamcli compose, bundle install,
and the installed binary actually executing inside the sandbox.

devbox.lock

@@ -1,6 +1,68 @@
 {
   "lockfile_version": "1",
   "packages": {
+    "appstream@latest": {
+      "last_modified": "2026-08-27T23:47:58Z",
+      "resolved": "github:NixOS/nixpkgs/7d1a7c21a4c00ea653fc7ed5c083d261340f185f#appstream",
+      "source": "devbox-search",
+      "version": "1.1.3",
+      "systems": {
+        "aarch64-darwin": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/zrpxip93379i7iphgi9r12vfkmjpln8k-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/c3svyp4qcd4kwscjjhba6r5ajm2kfr0q-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/2b6x9xz39605jg62jjvcc2d6iszs5ylj-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/zrpxip93379i7iphgi9r12vfkmjpln8k-appstream-1.1.3"
+        },
+        "aarch64-linux": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/66jhy5isw71z0xmwsva5wbj0cl65b04j-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/akhbgsjmqkwcfp219bv3mszmfhjvv3gl-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/xvr3ldwd4vk8fiky1lbbq8fp3a6kyzms-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/66jhy5isw71z0xmwsva5wbj0cl65b04j-appstream-1.1.3"
+        },
+        "x86_64-linux": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/i2azliw8fyn0dv751hkwcjp25w0k3raq-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/xxw2gcxw4fjhrz7flkrmsc9n75fnadcy-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/4gbbz6ip5lmblfsl33xdxhrdpj9mgzk7-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/i2azliw8fyn0dv751hkwcjp25w0k3raq-appstream-1.1.3"
+        }
+      }
+    },
     "cargo@latest": {
       "last_modified": "2026-08-27T07:16:00Z",
       "resolved": "github:NixOS/nixpkgs/c27cdad491a991b11ed731760aa2ef8db0cb0410#cargo",