feat(flatpak): sandbox zathura + add mpv hybrid for browser/mail handoffs

Defense-in-depth for the cross-sandbox handoff vector: when the
LibreWolf/Thunderbird flatpaks open a downloaded PDF or video via the
OpenURI portal, the receiving app currently runs natively with full
$HOME access — defeating part of the browser/mail isolation.

- meta/flatpak.txt: add org.pwmt.zathura, io.mpv.Mpv
- meta/wayland.txt: drop native zathura + zathura-pdf-mupdf
- meta/media.txt: keep native mpv (streamlink, /tmp/mpvsocket IPC,
  fast yt-dlp) — flatpak mpv is *additional*, only as the mimeapps
  default for video/audio to receive sandboxed handoffs
- dot_config/mimeapps.list: rewrite mpv.desktop -> io.mpv.Mpv.desktop,
  zathura-pdf-mupdf.desktop -> org.pwmt.zathura.desktop, and replace
  stale userapp-Thunderbird-* entries with org.mozilla.Thunderbird.desktop
- run_onchange_after_deploy-flatpak-overrides.sh.tmpl (new):
  --filesystem=xdg-config/{zathura,mpv}:ro so the flatpaks read our
  chezmoi-managed configs as a single source of truth
- README: media row + new deploy-script row

Manual one-shot on host: chezmoi apply -v.
The pteid bridge already iterates a flatpak app list, so cartão de
cidadão remains correctly registered for the Mozilla flatpaks. Native
mpv config (input-ipc-server) keeps working since each flatpak has its
own /tmp; no socket collision.

0 files changed, 0 insertions, 0 deletions