Add Flatpak install method to desktop CLI validation

[kantord]

this is related to this PR in the desktop app: stacklok/toolhive-studio#1670 that fixes some things in the flatpak build system.

Why a new install method

Flatpak apps run in an isolated environment. In order to keep things working properly & actually leverage this, the CLI also needs to be ran with flatpak run. This means we cannot just create a symlink, like we do on Linux normally. Instead, the desktop app will add a wrapper script under the thv name that will run the binary using flatpak.

From the user perspective - and as of today, from thv's perspective, the behavior and logic is exactly the same as with the symlink method, however the actual technical implementation on the toolhive-studio side is completely different. So to avoid future problems, it is reasonable to distinguish these 2 cases today. This way the code is also more self-documenting, we will not miss the fact that we need to be aware of this issue.

How it was tested

First, I tested that the algorithm used in stacklok/toolhive-studio#1670 works with the symlink method. Then, I made the changes you see in this PR and tested it using the following steps:

1. Built and installed the flatpak with the new install_method: "flatpak" + flatpak_target field
2. Launched the app — marker file written with install_method: "flatpak" and flatpak_target: ~/.local/share/flatpak/app/com.stacklok.ToolHive/x86_64/master/active/files/toolhive/resources/bin/linux-x64/thv
3. Verified that host-visible path exists on the real filesystem (not inside the sandbox)
4. Verified ~/.toolhive/bin/thv wrapper script works (thv version, thv list)
5. Built thv from Go source with the flatpak install method support (go build -o /tmp/thv-test ./cmd/thv)
6. Ran /tmp/thv-test version — blocked with "CLI conflict detected", exit code 1. The Go validation read flatpak_target, found the binary, and refused to run.
7. Uninstalled the flatpak
8. Verified the host-visible path is now gone
9. Ran /tmp/thv-test version again — runs normally, exit code 0, no conflict

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.20%. Comparing base (65f28eb) to head (e597725).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3895      +/-   ##
==========================================
+ Coverage   67.18%   67.20%   +0.02%     
==========================================
  Files         448      448              
  Lines       45218    45220       +2     
==========================================
+ Hits        30380    30392      +12     
+ Misses      12469    12458      -11     
- Partials     2369     2370       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[samuv]

Nice!

[aponcedeleonch]

nice!