build: export the app icon via --disable-sandbox instead of dropping it

flatpak build-export validates exported icons in a bwrap sandbox that
fails in an unprivileged CI container. The previous workaround stripped
build-dir/export/share/icons entirely, but flatpak exports the host icon
from that tree at install time, so the host menu and the window/alt-tab
icon were left generic on every machine - even ones where validation
would have passed.

Use 'flatpak build-export --disable-sandbox', which runs the same icon
validation in-process (no bwrap/userns) and keeps the icon in the export,
so it reaches the host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -180,11 +180,13 @@ These were confirmed by inspecting and running the v26.05 package (`opt/O3DE/26.
   `--regset`. Real project data (projects you create, their caches) lives under
   your home directory and is fully writable, so actual work is unaffected.
 - **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only
-  in-editor asset icons). It's kept *inside* the app so the running window/taskbar
-  shows it, but removed from the *exported* set because `flatpak build-export`
-  validates exported icons in a bwrap sandbox that fails in an unprivileged
-  container. Consequence: the host menu launcher icon is generic. A privileged
-  runner would let us export it properly.
+  in-editor asset icons). `flatpak build-export` validates exported icons in a
+  bwrap sandbox that fails in an unprivileged container ("is not a valid icon:
+  bwrap …"), so the build exports with `--disable-sandbox`: the icon is still
+  validated, but in-process rather than via bwrap/userns. The icon is now
+  exported to the host, so the menu launcher shows it; the window/alt-tab icon
+  also picks it up as long as the compositor matches the window to the desktop
+  entry (`StartupWMClass=O3DE` must equal the window's `WM_CLASS`).
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.