build: export the app icon via --disable-sandbox instead of dropping it

flatpak build-export validates exported icons in a bwrap sandbox that
fails in an unprivileged CI container. The previous workaround stripped
build-dir/export/share/icons entirely, but flatpak exports the host icon
from that tree at install time, so the host menu and the window/alt-tab
icon were left generic on every machine - even ones where validation
would have passed.

Use 'flatpak build-export --disable-sandbox', which runs the same icon
validation in-process (no bwrap/userns) and keeps the icon in the export,
so it reaches the host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/make-flatpak.sh

@@ -84,12 +84,12 @@ flatpak build-finish build-dir \
 
 echo ">> export to OSTree repo"
 # flatpak build-export validates exported app icons in a bwrap sandbox, which
-# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The
-# icon stays inside the app (so the running window/taskbar shows it); we just
-# drop it from the *exported* set so export skips validation. Trade-off: the
-# host menu launcher icon is generic. (A privileged runner would avoid this.)
-rm -rf build-dir/export/share/icons
-flatpak build-export repo build-dir "$BRANCH"
+# fails in an unprivileged container ("is not a valid icon: bwrap ..."). Rather
+# than drop the icon from the export (which left the host menu and the window /
+# alt-tab icon generic, because flatpak exports the host icon from this tree at
+# install time), --disable-sandbox runs the same icon validation in-process,
+# without bwrap. The icon is still validated; it just no longer needs userns.
+flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1
 
 echo ">> done: ./repo"