feat(pkg): publish an installable package on every release - #12

Installs system-wide what ./install.sh installs into $HOME: the CLI, the python
package, modules/ and config/ under /usr/share, the udev rule, the modules-load
drop-in and the user unit. Built for real on the target hardware from the v0.4.0
tarball -- 5.3 MB, and every path verified with `tar -tf` rather than assumed.

Two things the real build taught, neither of which the tests saw first:

The Material Symbols font is fetched by install.sh:27 from `master`, unpinned.
Downloading it today from the commit this PKGBUILD pins gives a DIFFERENT file
from the copy installed on 2 Sep -- 15,107,604 bytes against 15,090,976. Two
machines set up a week apart do not have the same font. The commit is pinned and
both checksums are real.

The .codepoints file is gitignored, so it is absent from the release tarball --
and draw.py:57 opens it. The first version of this PKGBUILD had `|| true` on that
install line, which silently produced a package with an empty fonts/ directory
and a bar with no icons. It is now a third pinned source and the `|| true` is
gone; a test asserts no `|| true` survives on a non-comment line.

pkgver carries release-please's `x-release-please-version` marker and the config
lists PKGBUILD under extra-files, so the version is maintained rather than
hand-bumped. A test pins both -- without them a release ships a package built
from the previous tag's number, silently.

tests/test_pkgbuild.py keeps the two install channels from drifting: everything
install.sh copies must appear in package(). It also records the asymmetry that
caused this issue -- macarchy_touchbar/, modules/ and config/ are NOT copied by
install.sh, because the daemon reads them in place from the checkout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SYBhT1xfp3MQ1w3687F4Mp

Builds the PKGBUILD in archlinux:base-devel when a release is published and
uploads the result onto that release, so `pacman -U` becomes a real way to
install this. macarchy-install#16.

Release-only on purpose: the PKGBUILD's source is the release tarball, which
does not exist until the tag does, so a push or pull_request trigger could only
ever fail. workflow_dispatch takes a tag for re-running a job that failed.

The upload globs `*.pkg.tar.*` rather than naming an extension -- PKGEXT is .zst
in this container and .xz on the maintainer's machine, and hardcoding either
uploads nothing on the other. --clobber so a re-run replaces the asset.

makepkg runs as a throwaway non-root user because it refuses to run as root, and
with --nodeps because `depends` is a runtime contract for the target machine,
not a build requirement for the container.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SYBhT1xfp3MQ1w3687F4Mp

Eleven findings, and the first would have made the whole feature a decoration.

CRITICAL -- `release: [published]` would never have fired. release-please creates
the Release with the default GITHUB_TOKEN, and GitHub raises no workflow run from
a GITHUB_TOKEN event. Every release would have published with no package and no
failed run anywhere to notice. This repo has already paid for that lesson once,
which is why the Tauri build was folded into release-please.yml; package.yml is
deleted and the job now hangs off release-please's own `release_created` output.

HIGH -- the shipped unit says ExecStart=%h/.local/bin/…, written for install.sh's
symlink. A package writes nothing into $HOME, so it would have given 203/EXEC,
ten restarts to StartLimitBurst and an OnFailure toast, from a package that
installed perfectly. package() now rewrites it to /usr/bin and greps to confirm.

HIGH -- `gh` lives on the runner, not inside the container; the upload would have
died with command not found. github-cli added, and `pacman -Sy` became -Syu so a
partial upgrade cannot link the fresh python against a glibc the image lacks.

HIGH -- arch=('any') with a site-packages path derived from the BUILDING
interpreter bakes that container's python version into the artifact; Asahi's
python trails it, and the target gets ImportError while depends=('python') claims
otherwise. Fixed by co-locating: macarchy_touchbar/ now installs NEXT TO modules/
and config/ under /usr/share/macarchy-touchbar, so "one directory above the
package" resolves in both layouts and there is one rule instead of two. That also
dissolves the finding that PACKAGED outranked the checkout and let an installed
package hijack every checkout on the machine -- there is no PACKAGED any more.

MEDIUM -- pacman cannot do install.sh's non-file half (video group, uinput,
masking tiny-dfr), so a package-only install left a blank bar with no explanation.
macarchy-touchbar.install now prints those steps, restarts on upgrade and hands
the panel back to tiny-dfr on removal.

MEDIUM -- workflow_dispatch checked out the default branch, so re-running for an
older tag built main's PKGBUILD and clobbered that package onto the old release.
It takes an explicit ref now, and the upload refuses a package whose filename
does not carry the target tag.

LOW -- the drift test matched the whole file including comments, which name every
artefact, so deleting an install line still passed: it reads comment-stripped code
now. CODEPOINTS froze data_root() at import while daemon.py called it per use;
it is codepoints_path() (renamed to avoid colliding with the existing _codepoints
cache). The checkout test never patched PACKAGED and would have started asserting
against packaged data once this shipped.

Rebuilt and re-verified rather than assumed: the unit reads
ExecStart=/usr/bin/macarchy-touchbar, nothing lands in site-packages, and the
launcher resolves from a checkout, from a simulated /usr prefix via the env var,
and fails with the list of places it looked when the tree is genuinely absent.

Suite: 159 passed, 2 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SYBhT1xfp3MQ1w3687F4Mp