flatpak-builder doesn't support --env-var, so we inject the secrets directly into the manifest's build-options.env before building. cc