feat(packages): split GNOME -- new packages-gnome-flatpak-runtime for WSLg portals

The dev_overlay default previously skipped `gnome` entirely, which
removed not just the heavy session pieces (gnome-shell / GDM /
control-center) but also the runtime bits Flatpaks need to function
on WSLg: xdg-desktop-portal* (file dialogs), pipewire/wireplumber
(audio routing), gstreamer base (media-render helpers), gvfs
(SMB/MTP traversal in Nautilus), Qt-Adwaita theming for non-GTK
Flatpaks (Wireshark etc.), flatpak itself.

Without those, GUIs routed through WSLg render glitchy file dialogs,
no audio, broken theming. So GNOME core IS needed on the dev VM --
just not the session.

New section: packages-gnome-flatpak-runtime
  - xdg-user-dirs, xdg-utils
  - xdg-desktop-portal, xdg-desktop-portal-gnome, xdg-desktop-portal-gtk
  - pipewire-alsa, pipewire-pulseaudio, wireplumber
  - gstreamer1, gstreamer1-plugins-base, gstreamer1-plugins-good
  - gvfs, gvfs-smb, gvfs-mtp
  - glibc-langpack-en
  - qt6-qtbase-gui, qt6-qtwayland, qadwaitadecorations-qt5, adw-gtk3-theme
  - flatpak

Existing packages-gnome (full session: gnome-shell, gnome-session-
wayland-session, GDM, control-center, gnome-keyring, extensions,
gnome-bluetooth, NetworkManager-wifi, etc.) is kept as-is and
remains the right choice for deployed bare-metal / Hyper-V / QEMU
MiOS hosts.

mios.toml [packages.dev_overlay].sections: add gnome-flatpak-runtime
to both vendor and bootstrap defaults. Operators who want the full
GNOME desktop on the dev VM tick `gnome` in the configurator.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94

usr/share/mios/PACKAGES.md

@@ -237,6 +237,57 @@ qadwaitadecorations-qt5
 adw-gtk3-theme
 ```
 
+## GNOME Flatpak Runtime -- portals + audio + theming for Flatpaks via WSLg
+
+The MiOS-DEV podman backend (Windows-side) does not host its own
+GNOME session -- WSLg is the Windows compositor and operators see
+Flatpaks (Ptyxis terminal, Nautilus file manager, Bazaar app store,
+Epiphany browser, Flatseal permissions UI) as Windows windows routed
+through the WSLg portal. Those Flatpaks ship their own GTK/libadwaita
+via `org.gnome.Platform`, but they still need a **host portal +
+audio router + Qt-Adwaita theming** so file dialogs, drag-and-drop,
+audio output, and consistent theming all work. This section is the
+**runtime-only** subset of `packages-gnome` -- the bits required for
+Flatpaks to function on the dev VM, with **no display manager, no
+gnome-shell, no GDM, no session services**.
+
+Deployed bare-metal / Hyper-V / QEMU MiOS hosts install
+`packages-gnome` (full session) instead.
+
+```packages-gnome-flatpak-runtime
+# ── Portals: file dialogs / drag-and-drop / desktop integration ──
+xdg-user-dirs
+xdg-utils
+xdg-desktop-portal
+xdg-desktop-portal-gnome
+xdg-desktop-portal-gtk
+# ── Audio: PipeWire is the host router; Flatpaks bind to it via
+#    portal sockets ──
+pipewire-alsa
+pipewire-pulseaudio
+wireplumber
+# ── GStreamer base: required by libsoup / libgweather inside
+#    Flatpak runtimes for media-rendering helpers ──
+gstreamer1
+gstreamer1-plugins-base
+gstreamer1-plugins-good
+# ── GVFS: lets Nautilus / Bazaar / Ptyxis traverse SMB / MTP /
+#    other backend filesystems via the host ──
+gvfs
+gvfs-smb
+gvfs-mtp
+# ── Locale ──
+glibc-langpack-en
+# ── Qt Adwaita theming -- so Qt apps (e.g. Wireshark Flatpak)
+#    match GNOME look on WSLg ──
+qt6-qtbase-gui
+qt6-qtwayland
+qadwaitadecorations-qt5
+adw-gtk3-theme
+# ── Flatpak itself + Bazaar / gnome-software handle install/upgrade ──
+flatpak
+```
+
 ## GNOME Core Apps -- DO NOT INSTALL AS RPM
 
 **PROJECT INVARIANT:** GNOME Core apps are user-facing applications and

usr/share/mios/mios.toml

@@ -222,13 +222,18 @@ sections = [
 
 [packages.dev_overlay]
 # MiOS-DEV (podman-WSL2 backend on Windows) minimal-but-complete:
-# every operator/dev/security daemon + the GPU CDI plumbing for /dev/dxg,
-# but NO desktop session (gnome/phosh) -- Ptyxis/Bazaar/Nautilus run as
-# Flatpaks routed through WSLg, the dev VM doesn't host its own session.
+# every operator/dev/security daemon + the GPU CDI plumbing for /dev/dxg
+# + the GNOME Flatpak runtime (portals/audio/theming) so the GNOME
+# Flatpaks (Ptyxis, Nautilus, Bazaar, Epiphany, Flatseal) routed through
+# WSLg can render with file dialogs / audio / Adwaita theming intact.
+# NO full GNOME session (no gnome-shell / GDM / control-center) -- the
+# dev VM is a podman backend, not a workstation; the Windows compositor
+# IS the WSLg surface.
 sections = [
     "base", "security", "utils", "build-toolchain", "containers",
     "cockpit", "storage", "virt",
     "gpu-mesa", "gpu-nvidia", "gpu-amd-compute", "gpu-intel-compute",
+    "gnome-flatpak-runtime",
     "ai", "sbom-tools", "self-build", "network-discovery", "updater",
     "cockpit-plugins-build", "k3s-selinux-build", "uki",
 ]