Voice alerts still silent on the Linux Flatpak build

Split out from #1834. Enabling Chromium's `--enable-speech-dispatcher` switch (done in the #1834 fix) makes voice alerts work on the Linux AppImage build when the host has a speech stack, but the Flatpak build stays silent even on the same host.

Findings from investigating #1834:

- Chromium `dlopen`s the host `libspeechd.so.2` and talks to the host speech-dispatcher daemon; the sandbox blocks both by default.
- The upstream-accepted permission is `--filesystem=xdg-run/speech-dispatcher:ro` (used by the Firefox/Thunderbird Flatpaks), not a `--talk-name`.
- `org.electronjs.Electron2.BaseApp` already ships a `libspeechd` module on newer branches, but Cockpit pins the EOL `22.08` for `base`/`baseVersion`/`runtimeVersion`.
- Inside the sandbox libspeechd cannot autospawn the daemon (no `speech-dispatcher` binary in-sandbox), so the host daemon must already be running. That is automatic only with speech-dispatcher >= 0.12 socket activation; older hosts need `speech-dispatcher -d -t 0` running first. This is why the AppImage works and the Flatpak does not on the same machine.

Proposed work:

- Bump `base`/`baseVersion`/`runtimeVersion` off `22.08` to a branch that ships `libspeechd`.
- Add `--filesystem=xdg-run/speech-dispatcher:ro` to the Flatpak `finishArgs`.
- Decide how to handle the daemon-must-be-running constraint (document it, or bundle a self-contained synthesizer).

Supersedes draft PR #2767.

Start by locating the Flatpak manifest and its finishArgs, then inspect where base, baseVersion, and runtimeVersion are pinned to 22.08. Verify the available Electron BaseApp branch and speech-dispatcher runtime behavior; done means the Flatpak can access the host speech socket and the daemon requirement is documented or resolved.

Written by the indexing model from the issue text.