ci(updater): pass --no-default-features in sandboxed builds

Snap and Flathub builds now invoke
`npm run tauri build -- --no-bundle -- --no-default-features` so
cargo compiles without the `updater` feature, excluding
tauri-plugin-updater and tauri-plugin-process from the binary and
satisfying store policies that prohibit competing auto-updaters.

cc

packaging/flatpak/com.blitzfc.qbz.yml

@@ -147,7 +147,10 @@ modules:
     build-commands:
       - npm ci
       - export PATH="$PWD/node_modules/.bin:$PATH" && npm run build
-      - export PATH="$PWD/node_modules/.bin:$PATH" && npm run tauri build -- --no-bundle
+      # Flathub policy: no competing auto-updaters. Disable the `updater`
+      # Cargo feature so tauri-plugin-updater / tauri-plugin-process are
+      # not linked into the Flatpak binary.
+      - export PATH="$PWD/node_modules/.bin:$PATH" && npm run tauri build -- --no-bundle -- --no-default-features
       - install -Dm755 src-tauri/target/release/qbz /app/bin/qbz
       - install -Dm644 packaging/flatpak/com.blitzfc.qbz.desktop /app/share/applications/com.blitzfc.qbz.desktop
       - install -Dm644 packaging/flatpak/com.blitzfc.qbz.metainfo.xml /app/share/metainfo/com.blitzfc.qbz.metainfo.xml