build(appimage): harden thin bundle workflow

Keep host multimedia libraries out of the AppImage, document the exact Ubuntu build inputs, and resolve Rust 1.97 release-gate warnings.

packaging/appimage/build-appimage.sh

@@ -8,9 +8,12 @@
 # X11) is dlopen'd at runtime and is on the AppImage excludelist because it must
 # match the host driver, and pixelpass's capture/encode tools (gst-launch-1.0,
 # pactl, mpv) are expected on the host PATH. So the AppImage carries just the two
-# binaries plus their handful of non-excludelisted libs. The custom AppRun
-# prepends usr/bin to PATH so peerspeak's own $PATH lookup finds the bundled
-# pixelpass, while the host's tools stay reachable.
+# binaries plus their handful of non-excludelisted libs. PulseAudio's client
+# stack is also excluded: pixelpass shells out to host GStreamer, and letting
+# those subprocesses inherit Ubuntu's bundled libsndfile/libmpg123 stack can
+# override incompatible host multimedia libraries. The custom AppRun prepends
+# usr/bin to PATH so peerspeak's own $PATH lookup finds the bundled pixelpass,
+# while the host's tools and matching audio stack stay reachable.
 #
 # All runtime assets (notification WAVs, avatar presets, window icon, fonts) are
 # include_bytes!-embedded in the peerspeak binary, so nothing else is bundled.
@@ -80,6 +83,7 @@ echo ">> running linuxdeploy (bundles libs, builds the AppImage)"
     --appdir "$appdir" \
     -e "$appdir/usr/bin/peerspeak" \
     -e "$appdir/usr/bin/pixelpass" \
+    --exclude-library 'lib*.so*' \
     -d "$repo/packaging/peerspeak.desktop" \
     -i "$repo/assets/icons/peerspeak-256.png" \
     --icon-filename peerspeak \