build_all: --ram mode (build scratch on tmpfs) for slow storage

Redirect the per-channel build scratch to /dev/shm and skip UPX, a big win when
building from a USB stick / SD card (I/O-bound on flash):
- TMPDIR + PIP_CACHE_DIR -> tmpfs
- PyInstaller: --workpath -> tmpfs (PYI_WORKPATH); UPX off via TESTIUM_NO_UPX
- Flatpak: build dir + ostree repo -> tmpfs (FLATPAK_BUILDDIR/REPODIR); the
  .flatpak-builder download cache stays on disk
- AppImage: bind-mount a tmpfs dir at the in-container AppDir path
  (APPIMAGE_APPDIR_TMPFS)
Scratch is freed on exit. Each build.sh honors the env vars with on-disk
defaults, so behavior is unchanged without --ram. With --ram, prefer --serial
on RAM-limited machines (flatpak+appimage are ~1 GB each).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

package/appimage/build.sh

@@ -17,11 +17,20 @@ else
 fi
 echo "Using $RUNTIME — building testium $APP_VERSION AppImage..."
 
+# APPIMAGE_APPDIR_TMPFS (set by build_all --ram) bind-mounts a host tmpfs dir at
+# the AppDir build path, keeping the ~1 GB AppDir churn off slow storage.
+APPDIR_MOUNT=""
+if [ -n "$APPIMAGE_APPDIR_TMPFS" ]; then
+    mkdir -p "$APPIMAGE_APPDIR_TMPFS"
+    APPDIR_MOUNT="-v $APPIMAGE_APPDIR_TMPFS:/work/package/appimage/AppDir"
+fi
+
 # APPIMAGE_EXTRACT_AND_RUN=1 lets appimagetool run without FUSE in the container.
 $RUNTIME run --rm \
     --privileged \
     -e APPIMAGE_EXTRACT_AND_RUN=1 \
     -v "$REPO_ROOT:/work" \
+    $APPDIR_MOUNT \
     -w /work/package/appimage \
     debian:bookworm bash -c "
         set -e