fix(packaging): improve Linux runtime smoke diagnostics

tools/embedded-mpv/README.md

@@ -232,6 +232,9 @@ shared-memory ring named `/impv-fc-runtime-probe-<pid>`. It does not open media
 or enter media/command loops. A timeout, loader failure, malformed protocol,
 missing file, hash mismatch, unusable graphics path, or shm lifecycle failure
 returns a stable reason and keeps the BrowserWindow sandbox enabled. The
+application diagnostic retains `helper-probe-failed` as the top-level reason
+for nonzero helper exits and adds `helperReason` only when the helper emitted
+one exact protocol-v1 line with a fixed allowlisted reason. The
 installed-Snap probe therefore tests the private shared-memory confinement
 needed by playback rather than only loader and graphics startup.
 Packaging CI invokes the same gate through

tools/packaging/configure-linux-frame-copy-build.test.mjs

@@ -518,6 +518,23 @@ test('Linux CI verifies every package family and exercises intended environments
     assert.doesNotMatch(buildWorkflow, /\bldd\b/);
 });
 
+test('Flatpak application runtime probe runs under an isolated D-Bus session', () => {
+    const installStep = workflowStep('Install Linux system dependencies');
+    const flatpakVerificationStep = workflowStep(
+        'Verify Flatpak payload, launcher, and sandboxed runtime'
+    );
+
+    assert.match(
+        flatpakVerificationStep,
+        /xvfb-run -a dbus-run-session -- flatpak run\s+\\\s+--env=LIBGL_ALWAYS_SOFTWARE=1\s+\\\s+com\.fourgray\.iptvnator\s+\\\s+--embedded-mpv-runtime-probe/
+    );
+    assert.match(installStep, /^\s+dbus-daemon\s+\\$/m);
+    assert.match(
+        flatpakVerificationStep,
+        /xvfb-run -a env LIBGL_ALWAYS_SOFTWARE=1\s+\\\s+flatpak run --command=sh com\.fourgray\.iptvnator/
+    );
+});
+
 test('foreign DEB CI explicitly selects both marker-only ARM architectures', () => {
     const foreignDebStep = workflowStep(
         'Make marker-only foreign-architecture DEB packages'