feat(flatpak): sandbox zathura + add mpv hybrid for browser/mail handoffs

Defense-in-depth for the cross-sandbox handoff vector: when the
LibreWolf/Thunderbird flatpaks open a downloaded PDF or video via the
OpenURI portal, the receiving app currently runs natively with full
$HOME access — defeating part of the browser/mail isolation.

- meta/flatpak.txt: add org.pwmt.zathura, io.mpv.Mpv
- meta/wayland.txt: drop native zathura + zathura-pdf-mupdf
- meta/media.txt: keep native mpv (streamlink, /tmp/mpvsocket IPC,
  fast yt-dlp) — flatpak mpv is *additional*, only as the mimeapps
  default for video/audio to receive sandboxed handoffs
- dot_config/mimeapps.list: rewrite mpv.desktop -> io.mpv.Mpv.desktop,
  zathura-pdf-mupdf.desktop -> org.pwmt.zathura.desktop, and replace
  stale userapp-Thunderbird-* entries with org.mozilla.Thunderbird.desktop
- run_onchange_after_deploy-flatpak-overrides.sh.tmpl (new):
  --filesystem=xdg-config/{zathura,mpv}:ro so the flatpaks read our
  chezmoi-managed configs as a single source of truth
- README: media row + new deploy-script row

Manual one-shot on host: chezmoi apply -v.
The pteid bridge already iterates a flatpak app list, so cartão de
cidadão remains correctly registered for the Mozilla flatpaks. Native
mpv config (input-ipc-server) keeps working since each flatpak has its
own /tmp; no socket collision.

1 files changed, 17 insertions, 0 deletions

diff --git a/run_onchange_after_deploy-flatpak-overrides.sh.tmpl b/run_onchange_after_deploy-flatpak-overrides.sh.tmpl
new file mode 100644
index 0000000..d8be763
--- /dev/null
+++ b/run_onchange_after_deploy-flatpak-overrides.sh.tmpl
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Read-only host config bindings for flatpaks that should pick up our
+# chezmoi-managed ~/.config/<app>/ rather than maintaining a separate
+# in-sandbox copy. Idempotent; flatpak override merges entries.
+#
+# script hash: {{ output "sh" "-c" (printf "sha256sum %q/run_onchange_after_deploy-flatpak-overrides.sh.tmpl 2>/dev/null || true" .chezmoi.sourceDir) }}
+set -eu
+
+apply() {
+	app=$1
+	shift
+	flatpak info --user "$app" >/dev/null 2>&1 || return 0
+	flatpak override --user "$@" "$app"
+}
+
+apply org.pwmt.zathura --filesystem=xdg-config/zathura:ro
+apply io.mpv.Mpv --filesystem=xdg-config/mpv:ro