build!: update Flutter desktop compatibility

[kimdongup]

Description

Align the desktop project and dependency locks with Flutter 3.47.2 / Dart 3.13 so the configured SDK, native plugins and build jobs use a compatible toolchain. Read OS icons through Flutter's binary AssetManifest API and finish loading them before starting the UI. The new packaged-asset regression test fails against the old JSON manifest loader and passes with this change.

Update the file picker call sites and declare user-selected read/write access in both macOS entitlement files. The resolved Darwin file picker checks these entitlements before opening a dialog. The existing screen layout is retained.

The Nix build uses a separate pinned Flutter input while retaining the existing Quickemu runtime input. Packaging commands use fastforge 0.6.12. CI adds formatting, analysis, tests and a macOS build, covers all pull requests to main, and keeps PPA/FlakeHub publishing restricted to the upstream repository.

Compatibility change: this raises the macOS deployment target from 10.14 to 12.0 and requires Flutter 3.47.2 / Dart 3.13 for source builds.

Related work: #303 covers the asset-manifest/startup problem; this patch uses Flutter's binary manifest API. #322 updates the packaging dependency that this patch replaces with fastforge. #317 also changes flake.lock and should be reconciled before merging. This PR does not close those broader proposals automatically.

Type of change

• Bug fix
• Packaging/build updates
• Breaking change: macOS minimum version and source toolchain requirements

Validation

Submitted head: 448e7e4922ec804578908f41ef07778deacf4dd2; base: 74949e086154f3f2d555f9268778545c78ff2b51.

• flutter pub get --enforce-lockfile: passed, committed lockfile unchanged.
• dart format --output=none --set-exit-if-changed lib test: passed, 32 files unchanged.
• flutter analyze --no-pub: passed, no issues.
• flutter test --no-pub --reporter expanded: passed, 2 tests. The new asset test fails with the old loader (AssetManifest.json is absent from the generated bundle).
• macOS Release build, bundle signature and runtime entitlements: passed on Intel macOS 15.7.9 (47.2 MB). Both the runner and App.framework contain x86_64 and arm64 slices; the signed app contains the file-picker entitlement; the built asset bundle contains AssetManifest.bin.
• Submitted-head Linux/macOS/Nix CI: passed on the fork: analysis/tests, Linux, Nix and macOS all succeeded; PPA was skipped by the repository condition.
• Upstream title validation passed. The upstream build run is action_required pending workflow approval.
• YAML/JSON dependency locks match; both entitlement files pass plist validation.

The existing window_size Swift Package Manager warning remains; the macOS build uses the CocoaPods fallback and exits 0.

This PR covers the build/startup compatibility foundation. Full installed-guest GUI acceptance and release-format packaging/publishing have not been validated on this branch. The macOS bundle is ad-hoc signed, not notarized. Further VM lifecycle and workspace fixes will follow as separate changes.

Checklist

• I have performed a self-review of my code.
• I have tested the compatibility paths listed above.
• I have updated and committed pubspec.yaml, pubspec.lock and pubspec.lock.json.
• Full installed-guest GUI acceptance on Linux and macOS.

[cubic-dev-ai]

All reported issues were addressed across 40 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>