test(flatpak): pin app-v1.43.0 commit for CI validation

Hardcode the upstream URL, tag, and commit in the manifest so the
build-flatpak CI job can run against the existing app-v1.43.0 release
without needing dynamic patching. Last.fm key injection still applies.

This branch is for CI smoke-testing only; flatpak-release has the
production-ready dynamic patching.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/reusable-channel-publish.yml

@@ -311,17 +311,8 @@ jobs:
             -o packages/flatpak/npm-sources.json
 
       - name: patch manifest for this release
-        env:
-          RELEASE_TAG: ${{ needs.create-release.outputs.release_tag }}
         run: |
-          git config --global --add safe.directory /__w/psysonic/psysonic
-          COMMIT=$(git ls-remote origin "refs/tags/${RELEASE_TAG}^{}" | awk '{print $1}')
-          if [ -z "$COMMIT" ]; then
-            COMMIT=$(git ls-remote origin "refs/tags/${RELEASE_TAG}" | awk '{print $1}')
-          fi
           sed -i \
-            -e "s|tag: app-v.*|tag: ${RELEASE_TAG}|" \
-            -e "s|commit: PLACEHOLDER_COMMIT|commit: ${COMMIT}|" \
             -e "s|VITE_LASTFM_API_KEY=__LASTFM_KEY__|VITE_LASTFM_API_KEY=${{ secrets.VITE_LASTFM_API_KEY }}|" \
             -e "s|VITE_LASTFM_API_SECRET=__LASTFM_SECRET__|VITE_LASTFM_API_SECRET=${{ secrets.VITE_LASTFM_API_SECRET }}|" \
             packages/flatpak/dev.psysonic.Psysonic.yml

packages/flatpak/dev.psysonic.Psysonic.yml

@@ -84,7 +84,7 @@ modules:
         url: https://github.com/Psychotoxical/psysonic.git
         # Updated automatically by the CI release job; bump manually for local builds
         tag: app-v1.43.0
-        commit: PLACEHOLDER_COMMIT
+        commit: 1ce199ee4b75f840b4d9798c147f799cabf23fc4
       # Generated by the CI job via flatpak-cargo-generator and flatpak-node-generator.
       # Committed into git only for the Flathub mirror repo (separate from this source
       # repo); locally, run the commands in CLAUDE.md to create them.