metainfo: stamp the release version at build time, add a screenshot, validate it

[Ryanmello07]

Stacked PR — depends on #5 and #7 (app icon).
Opened against main because a cross-fork PR needs its base branch to exist in
this repo, so the diff below currently includes its parent's changes too.
Review after its parent lands.

---

Three things the AppStream metadata needed before it could be submitted
anywhere — and one reason nothing caught them.

1. The release version was hardcoded, so it was wrong

Nothing wrote it, so the file said whatever was typed into it last while the
pipeline shipped something else. This element is not decoration: GNOME Software,
KDE Discover and the Flathub page all read <release version=…> and display it.

The file becomes a configure_file() template. app/meson.build derives both
attributes from -Dapp_version — which the pipeline already passes, and which
both binaries already compile in as UR_APP_VERSION — so there is now exactly
one place the release version is written down.

The full version is stamped, suffix and all. appstreamcli accepts it, and
truncating would advertise a version matching no artifact (every other consumer
of $VERSION — both binaries, every package filename, the release-asset gates —
uses the whole string) and would collapse every build of the same UTC day into
one indistinguishable <release> element. Only the date is derived, from the
leading <YYYY>.<M>.<D>.

When -Dapp_version is not passed, meson warns loudly. That branch cannot be
caught any other way: a document saying version="0.0.0" is perfectly valid
AppStream, so no validator objects — it just appears on the store page.

2. No screenshot

Flathub requires at least one, and it is the single largest thing a store
listing is judged on. Added as a committed PNG plus the raw URL Flathub mirrors
from; a repo-relative path does not work, because the mirror step runs on a
build host that only has the URL. The declared width/height match the file
exactly (1600×970), which Flathub's linter checks.

3. Nothing validated the file

Which is how (1) survived. appstreamcli is the validator Flathub gates
submissions on, so it now runs in two places, against the generated file
rather than the template:

• a meson test() — optional, because not every build host ships appstreamcli;
• a step in the gui CI job, which is the one that always will.

Verified

appstreamcli validate --no-net --pedantic passes on the stamped output for a
real release version and for the 0.0.0 sentinel. The meson date derivation was
exercised standalone for 2026.8.16-1020679030-beta → 2026-08-16,
2026.12.3-99 → 2026-12-03, a bare 2026.8.16, and 0.0.0 (warning branch).

Why this is split this way

The metainfo is the Flathub-blocker cluster, and it is the one place in this
series where a maintainer decision is genuinely being asked for (what the
listing says, what the screenshot shows). Keeping it out of the rename PR means
that decision is not buried under 29 files of string substitution.

Note: this PR appends appstream to the gui job's apt list and adds a step
at the end of that job. PR 1 (upstream/ci-job-timeouts) edits the same job.
They merge cleanly; if git ever disagrees, keep both changes.