build: decouple CI image producer from Flatpak policy

[grazzolini]

Summary

• Decouple the CI-image SoXR producer from Flatpak source policy, allowing Flatpak cache changes without rebuilding the shared CI image.
• Preserve the existing image pin, legacy build inputs, and strict consumer verifier.

Motivation

Refs #595. Flatpak source lists and cache configuration currently participate in the SoXR image recipe, coupling application packaging changes to CI-image publication.

Changes

• Add a permanent SoXR runtime recipe and neutral deterministic TAR serializer, with exported runner and helpers.
• Update Docker inputs, input manifests, publication filters, corresponding-source packaging, and process documentation.
• Cover legacy archive parity, old-image compatibility, complete corresponding sources, and rejection of genuine input mismatches.

Testing

• Passed: node --test scripts/ci-image-policy.test.mjs scripts/verify-ci-image.test.mjs scripts/build-ffmpeg.test.mjs scripts/flatpak-cache.test.mjs — 109 tests; strengthened policy/verifier coverage rerun afterward — 35 passed.
• Passed: pnpm lint, pnpm typecheck, node scripts/ci-image-policy.mjs, and git diff --check.
• pnpm test: 1,054 desktop tests passed; the suite stopped at the Android installer fixture with JDK 17 not found. Android/Linux tooling remains separate scope under Support Android packaging from Linux hosts #423. Rerun pnpm test in the configured CI environment.
• Passed separately: cargo test from apps/desktop/src-tauri, using the repository compiler setup and generated SoXR host-test runtime — 552 tests.
• Passed separately: cd apps/backend && uv run --no-sync --python 3.14 pytest — 891 tests.
• Passed after README feedback: node --test --test-name-pattern='repository satisfies CI image policy' scripts/ci-image-policy.test.mjs.
• Correctness review and focused documentation re-review found no actionable issues.
• Container execution was deferred to CI; no local image or Flatpak build was run. Local image-build command: docker buildx build --no-cache --platform linux/amd64 --load --file .github/ci/Dockerfile --tag tuneforge-ci:check .. The existing publication workflow builds the new image after merge to main; current PR consumers retain the old pinned image.

Checklist

• Conventional Commit title; one signed commit.
• Lint and typecheck passed.
• Full pnpm test gate passed; awaiting CI validation of the Android fixture.
• Relevant documentation updated.
• No secrets, credentials, copyrighted audio, or generated package artifacts added.

HTTP contracts, product behavior, and release-package outputs are unchanged; contract generation, changelog, UI media, and release-package gates do not apply.