Revert flatpak to building from source; add appstream package

Reusing the linux job's binary (previous commit) doesn't work: it's
dynamically linked against ~100 libraries at absolute /nix/store
paths, including its own ELF interpreter, none of which exist inside
the Flatpak sandbox - confirmed locally via a real install+run
(execvp: No such file or directory). Reverted to building from source
inside flatpak-builder's sandbox via the rust-stable SDK extension,
same as the existing local `devbox run package` already does.

Also fixes two things needed for that in-sandbox build to work under
the forgejo-runner service (not an interactive session):
- appstreamcli (used by flatpak-builder to compose AppStream metadata)
  wasn't on PATH - added as a devbox package (linux-only, like
  gtk4/libadwaita) rather than a NixOS system package, keeping it
  scoped to the project.
- rofiles-fuse's mount/unmount cycle fails under the service context
  even though /dev/fuse itself is world-writable; --disable-rofiles-fuse
  is flatpak-builder's own documented workaround for this.

Verified locally: full build, appstreamcli compose, bundle install,
and the installed binary actually executing inside the sandbox.

.forgejo/workflows/release.yml

@@ -103,26 +103,24 @@ jobs:
           name: carrier-linux-x86_64
           path: carrier/target/release/carrier-linux-x86_64
 
-  # Packages the linux job's already-built binary instead of recompiling
+  # Builds from source inside flatpak-builder's own sandbox, via the
-  # inside flatpak-builder's own sandbox: that sandbox copies the source
+  # rust-stable SDK extension (same as com.randogoth.carrier.json already
-  # tree in fresh, so it never sees ~/.cargo/registry or target/, making an
+  # does for local `devbox run package`). Reusing the linux job's binary
-  # in-sandbox cargo build fully redundant with the linux job's build.
+  # was tried and reverted: that binary is dynamically linked against ~100
-  # com.randogoth.carrier.release.json (not the main manifest, which is
+  # libraries at absolute /nix/store paths, including its own ELF
-  # still used by local `devbox run package` for from-source dev builds)
+  # interpreter - none of which exist inside the Flatpak sandbox, so it
-  # just installs this prebuilt binary instead of invoking cargo.
+  # can never execute there regardless of how it's packaged in.
   flatpak:
-    needs: [linux]
     runs-on: linux-x86_64
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
         with:
           path: carrier
-      - uses: https://code.forgejo.org/forgejo/download-artifact@v7
+      - uses: https://code.forgejo.org/actions/checkout@v4
         with:
-          name: carrier-linux-x86_64
+          repository: randogoth/fumi
-          path: carrier
+          ref: main
-      - run: chmod +x carrier-linux-x86_64
+          path: fumi
-        working-directory: carrier
       - run: devbox run bundle-flatpak
         working-directory: carrier
         env:

com.randogoth.carrier.release.json

@@ -1,45 +0,0 @@
-{
-  "id": "com.randogoth.carrier",
-  "runtime": "org.gnome.Platform",
-  "runtime-version": "51",
-  "sdk": "org.gnome.Sdk",
-  "command": "carrier",
-  "finish-args": [
-    "--socket=wayland",
-    "--socket=fallback-x11",
-    "--device=dri",
-    "--share=network"
-  ],
-  "cleanup": [
-    "/share/doc"
-  ],
-  "modules": [
-    {
-      "name": "carrier",
-      "buildsystem": "simple",
-      "build-commands": [
-        "install -Dm755 carrier-linux-x86_64 /app/bin/carrier",
-        "install -Dm644 data/com.randogoth.carrier.desktop /app/share/applications/com.randogoth.carrier.desktop",
-        "install -Dm644 data/com.randogoth.carrier.metainfo.xml /app/share/metainfo/com.randogoth.carrier.metainfo.xml",
-        "install -Dm644 data/icons/com.randogoth.carrier.png /app/share/icons/hicolor/512x512/apps/com.randogoth.carrier.png",
-        "install -Dm644 data/icons/com.randogoth.carrier-256.png /app/share/icons/hicolor/256x256/apps/com.randogoth.carrier.png",
-        "install -Dm644 data/icons/com.randogoth.carrier-128.png /app/share/icons/hicolor/128x128/apps/com.randogoth.carrier.png"
-      ],
-      "sources": [
-        {
-          "type": "dir",
-          "path": ".",
-          "skip": [
-            "target",
-            ".git",
-            ".jj",
-            ".flatpak",
-            ".flatpak-builder",
-            ".flatpak-repo",
-            ".flatpak-build"
-          ]
-        }
-      ]
-    }
-  ]
-}

devbox.json

@@ -14,6 +14,10 @@
       "version": "latest",
       "platforms": ["x86_64-linux", "aarch64-linux"],
       "outputs": ["out", "dev"]
+    },
+    "appstream": {
+      "version": "latest",
+      "platforms": ["x86_64-linux", "aarch64-linux"]
     }
   },
   "env": {
@@ -44,7 +48,7 @@
         "flatpak-builder --force-clean --user --install-deps-from=flathub --install .flatpak com.randogoth.carrier.json"
       ],
       "bundle-flatpak": [
-        "flatpak-builder --force-clean --user --disable-rofiles-fuse --repo=.flatpak-repo --install-deps-from=flathub .flatpak-build com.randogoth.carrier.release.json",
+        "flatpak-builder --force-clean --user --disable-rofiles-fuse --repo=.flatpak-repo --install-deps-from=flathub .flatpak-build com.randogoth.carrier.json",
         "flatpak build-bundle .flatpak-repo carrier-x86_64.flatpak com.randogoth.carrier"
       ]
     }

devbox.lock

@@ -1,6 +1,68 @@
 {
   "lockfile_version": "1",
   "packages": {
+    "appstream@latest": {
+      "last_modified": "2026-08-27T23:47:58Z",
+      "resolved": "github:NixOS/nixpkgs/7d1a7c21a4c00ea653fc7ed5c083d261340f185f#appstream",
+      "source": "devbox-search",
+      "version": "1.1.3",
+      "systems": {
+        "aarch64-darwin": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/zrpxip93379i7iphgi9r12vfkmjpln8k-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/c3svyp4qcd4kwscjjhba6r5ajm2kfr0q-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/2b6x9xz39605jg62jjvcc2d6iszs5ylj-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/zrpxip93379i7iphgi9r12vfkmjpln8k-appstream-1.1.3"
+        },
+        "aarch64-linux": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/66jhy5isw71z0xmwsva5wbj0cl65b04j-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/akhbgsjmqkwcfp219bv3mszmfhjvv3gl-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/xvr3ldwd4vk8fiky1lbbq8fp3a6kyzms-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/66jhy5isw71z0xmwsva5wbj0cl65b04j-appstream-1.1.3"
+        },
+        "x86_64-linux": {
+          "outputs": [
+            {
+              "name": "out",
+              "path": "/nix/store/i2azliw8fyn0dv751hkwcjp25w0k3raq-appstream-1.1.3",
+              "default": true
+            },
+            {
+              "name": "dev",
+              "path": "/nix/store/xxw2gcxw4fjhrz7flkrmsc9n75fnadcy-appstream-1.1.3-dev"
+            },
+            {
+              "name": "installedTests",
+              "path": "/nix/store/4gbbz6ip5lmblfsl33xdxhrdpj9mgzk7-appstream-1.1.3-installedTests"
+            }
+          ],
+          "store_path": "/nix/store/i2azliw8fyn0dv751hkwcjp25w0k3raq-appstream-1.1.3"
+        }
+      }
+    },
     "cargo@latest": {
       "last_modified": "2026-08-27T07:16:00Z",
       "resolved": "github:NixOS/nixpkgs/c27cdad491a991b11ed731760aa2ef8db0cb0410#cargo",