Migrate publish-flatpak.yml onto the shared tuna-os pipeline #85

blueshell's .github/workflows/publish-flatpak.yml is a ~200-line vendored copy of the tuna-os flatpak pipeline, including its own copy of .github/scripts/update-index.py. Every other flatpak app in the org (finupdate, mariner, mandelbrot, dualcut, the four installer frontends) is now a thin caller of the reusable tuna-os/.github/.github/workflows/publish-flatpak.yml, which is the direction tuna-os/tunaOS#1183 recommendation #2 set.

tuna-os/.github's flatpak-tooling-drift-check.yml watches eight repos' vendored update-index.py copies for drift. blueshell is not in that list — it joined the org after the check was written — so its copy is currently unwatched.

Not urgent, and deliberately not done as part of the Ghostty work (#83): blueshell's pipeline is the one that currently publishes successfully, and it carries two jobs the reusable workflow has no equivalent for:

• release-tip — pushes every ptyxis-port build to the rolling tip prerelease. Added deliberately in 34e90ce0b; without it the repo's only download is a workflow artifact that expires after 7 days.
• the index-snippet artifact, which makes a publish auditable when FLATPAK_INDEX_TOKEN is unset.

A migration therefore needs to keep release-tip as a separate job that needs: the reusable one and consumes its bundle artifacts, and should land on its own so a regression is isolated from other changes.

Either finish the migration, or add blueshell to the drift check's REPOS list so the vendored copy is at least watched.