build(appimage): harden thin bundle workflow

Keep host multimedia libraries out of the AppImage, document the exact Ubuntu build inputs, and resolve Rust 1.97 release-gate warnings.

packaging/appimage/README.md

@@ -24,7 +24,10 @@ The AppImage runs on any reasonably current glibc-based distro that has:
 
 - **A Vulkan-capable GPU + driver** (peerspeak's iced/wgpu renderer). Mesa/RADV
   on AMD/Intel or the NVIDIA driver all work.
-- **PipeWire** (with the PulseAudio shim, for `pactl`).
+- **PipeWire** with the PulseAudio shim, `pactl`, and the host `libpulse.so.0`
+  client library. The Pulse client stack is deliberately not bundled because
+  PixelPass launches host GStreamer tools that must keep using the host's
+  matching multimedia libraries.
 - For **screen-share only** — pixelpass shells out to these on the host `PATH`;
   it prints the exact package names for your distro if any are missing:
   - **GStreamer + plugins** (`gst-launch-1.0`/`gst-inspect-1.0`, base,
@@ -58,13 +61,23 @@ distrobox create --yes --image ubuntu:24.04 --name peerspeak-appimage
 distrobox enter peerspeak-appimage -- sudo apt-get update
 distrobox enter peerspeak-appimage -- sudo apt-get install -y \
   build-essential cmake clang libclang-dev pkg-config \
-  libpipewire-0.3-dev libspa-0.2-dev libasound2-dev libxcb1-dev \
+  libpipewire-0.3-dev libspa-0.2-dev libpulse-dev libasound2-dev libxcb1-dev \
   curl ca-certificates file patchelf git
+rustup toolchain install 1.97.1 --profile default
 
-# Build (the host's ~/.rustup toolchain is glibc-2.17-baseline, so it runs in the
-# box; isolated CARGO_TARGET_DIRs keep it off the host target/):
+# PeerSpeak's ownership validator needs the modern SPA-JSON parser headers it
+# is tested against. Distrobox exposes the host's headers under /run/host;
+# pkg-config still links Ubuntu's older ABI-compatible libraries, preserving
+# the glibc baseline. This checkout's verified host-header version is 1.6.8:
+test -f /run/host/usr/include/spa-0.2/spa/utils/json-core.h
+
+# Build with the repository's pinned Rust version (the host's ~/.rustup
+# toolchain is glibc-2.17-baseline, so it runs in the box; isolated
+# CARGO_TARGET_DIRs keep it off the host target/):
 distrobox enter peerspeak-appimage -- env \
-  PATH="$HOME/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH" \
+  PATH="$HOME/.rustup/toolchains/1.97.1-x86_64-unknown-linux-gnu/bin:$PATH" \
+  SYSTEM_DEPS_LIBSPA_INCLUDE="/run/host/usr/include/spa-0.2" \
+  SYSTEM_DEPS_LIBPIPEWIRE_INCLUDE="/run/host/usr/include/pipewire-0.3:/run/host/usr/include/spa-0.2" \
   ./packaging/appimage/build-appimage.sh
 ```