Fix o3de CLI install on read-only /app via prebuilt sdist

The real first-launch installer is python/get_python.sh, not LYPython.cmake.
It does `pip install -e scripts/o3de`, whose egg_info write hits read-only
/app and fails ([Errno 30]). get_python.sh has a built-in immutable-install
hook: if scripts/o3de/dist/o3de-1.0.0.tar.gz exists it installs that
(non-editable) instead. Pre-build that tarball at Flatpak build time
(python3 setup.py sdist) so the runtime CLI lands in the writable ~/.o3de
venv. Verified end-to-end: tarball install -> `import o3de` resolves from
site-packages.

Also patch every LYPython.cmake copy (not just the first) for the separate
project-build CMake-configure path, and add python3/python3-setuptools to CI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -87,8 +87,8 @@ the upstream version has no matching `vX.Y.Z` tag yet, so reruns are cheap no-op
 ## Building locally
 
 ```sh
-# flatpak + cmake (cmake is used by O3DE's get_python.sh) + curl
-sudo apt install flatpak cmake      # or your distro's equivalent
+# flatpak + curl + python3/setuptools (to pre-build the o3de sdist)
+sudo apt install flatpak python3-setuptools      # or your distro's equivalent
 ./scripts/build.sh
 ```
 
@@ -131,12 +131,19 @@ These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
   runtime and builds a venv under `~/.o3de` (writable), pip-installing its deps
   there. The build does **not** bundle Python — the venv is keyed to the user's
   home path, so it can only be created at runtime.
-- **The editable-install patch.** O3DE installs its own `o3de` CLI with
-  `pip install -e`, which writes an `egg-info` next to the source under read-only
-  `/app` and fails. The build patches `cmake/LYPython.cmake` to drop the `-e`, so
-  it's a normal install (built in a temp dir, landing in the writable `~/.o3de`
-  venv). If a future O3DE release changes that pip command, the build prints a
-  warning and Python setup will fail at runtime — that's the line to re-check.
+- **The o3de CLI install (read-only `/app`).** On first launch O3DE installs its
+  own `o3de` CLI from `scripts/o3de` into the per-user `~/.o3de` venv. By default
+  `python/get_python.sh` does an *editable* install (`pip install -e`), which
+  writes an `egg-info` next to the source under read-only `/app` and fails.
+  `get_python.sh` has a built-in immutable-install hook (the Snap path): if a
+  prebuilt sdist exists at `scripts/o3de/dist/o3de-1.0.0.tar.gz` it installs that
+  (non-editable) instead. The build pre-creates that tarball (`python3 setup.py
+  sdist`) while the tree is still writable, so at runtime the CLI lands in the
+  writable venv and nothing is written to `/app`. (The build also patches every
+  `cmake/LYPython.cmake` to a non-editable install, covering the separate
+  project-build CMake-configure path.) If a future release renames the package or
+  bumps its version away from `1.0.0`, the build fails fast — those are the lines
+  to re-check.
 - **Other runtime writes into the install tree may still fail.** Anything else
   O3DE tries to generate *inside* `/opt/O3DE/...` at runtime (e.g. certain per-gem
   Python deps, or the engine-level asset cache) hits the read-only `/app`. Project