Fix missing ffmpeg.so, build issues and timing, and runtime / sandboxing issues

[gurnben]

Human Pilot's Note

Claude and I beat our collective heads against the ffmpeg error and patched it up, alongside some other runtime issues and build-time issues. I've tested this locally on my machine with both local builds and the builds from CI. Speaking of CI, this PR also changes the release process to also push tagged releases to forks, so contributors can test CI builds off of their fork, but it should still release automatically and tag as the latest release if built off of @mattipunkt 's main repo!

I've also given every line of changes a personal review alongside my local testing. Hopefully this gets us up and running again!

Among other things, this should resolve #19

Fix Flatpak build, packaging, and runtime issues

This PR fixes a series of interconnected issues that prevented the Flatpak build from completing in CI and the installed Flatpak from running correctly.

Problem

The Flatpak package had multiple build and runtime failures:

1. CI build failures — stale config references, missing .gitignore , and flatpak-node-generator incompatibility with lockfile v3
2. libffmpeg.so missing at runtime — the Electron binary was copied to /app/bin/ but its shared libraries stayed at /app/ , and since Electron uses RPATH=$ORIGIN , the binary couldn't find them
3. Chrome sandbox crash — chrome-sandbox requires SUID root (mode 4755), which isn't possible inside a Flatpak container
4. "Missing X server" on Wayland — --socket=fallback-x11 only provides X11 when Wayland is unavailable, but Electron doesn't automatically use Wayland without explicit configuration

Changes

CI and build fixes

• Add .gitignore for flatpak build artifacts ( .flatpak-builder/ , _build/ , repo/ , generated-sources.json)
• Fix electron-builder.base.yml — add file exclusions for flatpak dirs, remove stale extraResources reference, add linux.maintainer
• Convert package-lock.json to lockfile v2 — flatpak-node-generator 0.1.1 can't process v3, producing only 30
sources instead of 1200+
• Fix CI workflow — correct generated-sources.json output path, support releases on forks with commit-suffixed tags
• Add skip patterns to flatpak type: dir source — prevents copying repo/ , _build/ , dist/ , .flatpak-builder/ into the build sandbox, which caused asar "file size > 4.2GB" errors on local rebuilds

Flatpak runtime fixes

• Use wrapper script pattern for Electron — copy the unpacked build to /app/main/ (keeping the binary alongside
libffmpeg.so and other shared libraries), and use a run.sh wrapper in /app/bin/ that execs the binary. This matches
the established pattern used by other Electron flatpaks (Bitwarden, XStreaming, etc.) and aligns with the desktop file
which already referenced run.sh
• Add org.electronjs.Electron2.BaseApp — provides zypak-wrapper , which replaces Chrome's SUID sandbox with Flatpak's own seccomp-based sandbox. The wrapper script now calls zypak-wrapper /app/main/qobuz-linux instead of executing the binary directly
• Use --socket=x11 instead of --socket=fallback-x11 — always provides XWayland so Electron has a display server on
Wayland sessions
• Set ELECTRON_OZONE_PLATFORM_HINT=auto — enables native Wayland support in Electron when available, with X11 fallback

Testing

• Local flatpak build and install verified working on Fedora/GNOME Wayland
• CI builds pass for both x86_64 and aarch64
• Application launches, loads Qobuz web player, and plays audio

[gurnben]

@mattipunkt no rush but once you're able to review this I think its ready to go, I've been using this change alongside my other changes on https://github.com/gurnben/qobuz-linux/tree/update-dependencies for almost a week and its working like a charm!

...except for the tray, which appears to have disappeared due to api changes under us. I'm working on patching that (unsuccessfully) on https://github.com/gurnben/qobuz-linux/tree/fix-system-tray!