build: export the app icon via --disable-sandbox instead of dropping it

flatpak build-export validates exported icons in a bwrap sandbox that
fails in an unprivileged CI container. The previous workaround stripped
build-dir/export/share/icons entirely, but flatpak exports the host icon
from that tree at install time, so the host menu and the window/alt-tab
icon were left generic on every machine - even ones where validation
would have passed.

Use 'flatpak build-export --disable-sandbox', which runs the same icon
validation in-process (no bwrap/userns) and keeps the icon in the export,
so it reaches the host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -180,11 +180,13 @@ These were confirmed by inspecting and running the v26.05 package (`opt/O3DE/26.
   `--regset`. Real project data (projects you create, their caches) lives under
   your home directory and is fully writable, so actual work is unaffected.
 - **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only
-  in-editor asset icons). It's kept *inside* the app so the running window/taskbar
-  shows it, but removed from the *exported* set because `flatpak build-export`
-  validates exported icons in a bwrap sandbox that fails in an unprivileged
-  container. Consequence: the host menu launcher icon is generic. A privileged
-  runner would let us export it properly.
+  in-editor asset icons). `flatpak build-export` validates exported icons in a
+  bwrap sandbox that fails in an unprivileged container ("is not a valid icon:
+  bwrap …"), so the build exports with `--disable-sandbox`: the icon is still
+  validated, but in-process rather than via bwrap/userns. The icon is now
+  exported to the host, so the menu launcher shows it; the window/alt-tab icon
+  also picks it up as long as the compositor matches the window to the desktop
+  entry (`StartupWMClass=O3DE` must equal the window's `WM_CLASS`).
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.

scripts/make-flatpak.sh

@@ -84,12 +84,12 @@ flatpak build-finish build-dir \
 
 echo ">> export to OSTree repo"
 # flatpak build-export validates exported app icons in a bwrap sandbox, which
-# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The
-# icon stays inside the app (so the running window/taskbar shows it); we just
-# drop it from the *exported* set so export skips validation. Trade-off: the
-# host menu launcher icon is generic. (A privileged runner would avoid this.)
-rm -rf build-dir/export/share/icons
-flatpak build-export repo build-dir "$BRANCH"
+# fails in an unprivileged container ("is not a valid icon: bwrap ..."). Rather
+# than drop the icon from the export (which left the host menu and the window /
+# alt-tab icon generic, because flatpak exports the host icon from this tree at
+# install time), --disable-sandbox runs the same icon validation in-process,
+# without bwrap. The icon is still validated; it just no longer needs userns.
+flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1
 
 echo ">> done: ./repo"