Add Flatpak build target for Silverblue/Aurora support

Flatpak is the primary app delivery mechanism on immutable Fedora
Atomic desktops like Silverblue and Aurora, which don't support
traditional deb/rpm installs well. This wires up electron-builder's
built-in flatpak target, pinned to the current org.electronjs.Electron2.BaseApp
runtime (25.08) with Wayland-first sandbox permissions, and installs
flatpak-builder plus the Flathub remote in CI so the bundle builds
and ships alongside the other Linux artifacts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/actions/build/action.yml

@@ -73,6 +73,20 @@ runs:
         sudo apt update
         sudo apt install libarchive-tools
 
+    - name: Install Flatpak build tools
+      shell: bash
+      if: runner.os == 'Linux'
+      run: |
+        sudo apt install -y flatpak flatpak-builder
+        flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+    - name: Cache Flatpak runtimes
+      if: runner.os == 'Linux'
+      uses: actions/cache@v5.0.5
+      with:
+        path: ~/.local/share/flatpak
+        key: flatpak-runtimes-${{ runner.os }}-25.08
+
     - name: Rebuild native modules for Electron
       shell: bash
       run: npx electron-rebuild
@@ -120,6 +134,7 @@ runs:
           dist/*.pacman
           dist/*.rpm
           dist/*.exe
+          dist/*.flatpak
 
     - name: Run E2E Tests
       shell: bash

.github/workflows/release.yml

@@ -195,4 +195,5 @@ jobs:
             artifacts/**/*.deb
             artifacts/**/*.pacman
             artifacts/**/*.rpm
-            artifacts/**/*.exe
+            artifacts/**/*.exe
+            artifacts/**/*.flatpak

electron-builder.json

@@ -24,7 +24,8 @@
       "AppImage",
       "rpm",
       "snap",
-      "pacman"
+      "pacman",
+      "flatpak"
     ]
   },
   "win": {
@@ -115,6 +116,22 @@
     "confinement": "classic",
     "publish": "github"
   },
+  "flatpak": {
+    "runtimeVersion": "25.08",
+    "baseVersion": "25.08",
+    "useWaylandFlags": true,
+    "finishArgs": [
+      "--socket=wayland",
+      "--socket=x11",
+      "--share=ipc",
+      "--device=dri",
+      "--socket=pulseaudio",
+      "--filesystem=home",
+      "--share=network",
+      "--talk-name=org.freedesktop.Notifications",
+      "--socket=ssh-auth"
+    ]
+  },
   "protocols": {
     "name": "ssh URL",
     "schemes": [