Fix real workflow bugs a review found: dead bind mount, blind error gate

A review found the "Validate with makepkg and namcap" step's bind mount
(docker run -v "$PWD/rendered:/work") would very likely fail on Gitea's
own act_runner: a containerized job's $PWD isn't a path the daemon's host
can resolve, so the mount would silently attach an empty directory
instead of failing loudly — the same class of problem noted elsewhere for
this exact environment. Switched to docker create + docker cp (in and
back out) + docker start -a, the pattern already validated locally, which
works regardless of where the daemon actually lives.

Also found and fixed, most severe first:

- The namcap error gate (`grep -q "^[a-zA-Z0-9_-]*bin E:"`) only matched
  one of namcap's two line shapes for reporting an error
  ("triple-c-bin E: ...") and missed the other ("PKGBUILD
  (triple-c-bin) E: ...") entirely — confirmed by reproducing both against
  a real namcap run. The PKGBUILD-level half of the safety net was dead.
  Replaced with a plain `grep -q " E: "`, confirmed to match both real
  shapes (and a split-package variant) and nothing else.
- package()'s `ar x "Triple-C_${pkgver}_amd64.deb"` named the asset
  literally, defeating the whole point of the resolve step discovering
  the real filename from the release instead of assuming a pattern — a
  future Tauri bundler naming change would still break here with an
  opaque error. Changed to `ar x ./*_amd64.deb`, which `source=()` already
  guarantees matches exactly one file.
- `pacman -Sy` before installing packages is the canonical Arch partial-
  upgrade footgun; changed to `pacman -Syu --noconfirm --needed`.
- `${{ inputs.version }}` was interpolated directly into a shell step
  instead of routed through `env:`, unlike every other step in the file.
- `git push origin master` assumes the local branch name after cloning a
  brand-new (not-yet-created) AUR repo's empty state is `master`, which
  depends on the runner's own `init.defaultBranch` if the server sends no
  symref. `git push origin HEAD:master` is unambiguous either way.
- The private key was written with a plain redirect then chmod'd after,
  leaving a window where it's world-readable; now created at its final
  mode first via `install -m 600 /dev/null`. Added `-o IdentitiesOnly=yes`
  so a runner ssh-agent can't offer a different key first.
- Added GH_PAT auth to the api.github.com calls, matching every other
  workflow in this repo, to avoid the unauthenticated 60/hour rate limit.
- Fixed two comments: the `options` comment credited `!debug` for
  suppressing the empty debug-package directory, when it's actually
  `!strip` doing that (verified in a real build); and documented in the
  README that a hand-edit made directly in the AUR repo is silently
  reverted by the next dispatch, since every run renders fresh from this
  repo's template.

All of the above re-verified with the same real end-to-end methodology as
the original commit: real makepkg build, real namcap lint (clean), and
the exact updated docker create/cp/start sequence run against a live
container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGjXq6fqtAFHdbhk4f3PfZ

packaging/arch/PKGBUILD

@@ -41,11 +41,15 @@ provides=('triple-c')
 conflicts=('triple-c')
 # !strip: the upstream .deb's binary is already the release build Tauri
 # produced and tested; re-stripping a prebuilt binary is unnecessary risk for
-# no benefit. !debug: there is no debug info in a release binary for
-# makepkg's debug-package machinery to extract, so without this it builds an
-# empty usr/src/debug/ tree for nothing (confirmed with namcap against a real
-# build — this was its only non-cosmetic complaint, once the license file
-# below was added).
+# no benefit. It's also what actually suppresses makepkg's debug-package
+# machinery here (debug-package extraction requires strip; verified in a
+# real build — with !strip alone, no debug package is produced at all).
+# !debug is kept anyway, explicit about intent rather than relying on that
+# side effect. Without either, makepkg built a usr/src/debug/triple-c-bin
+# tree containing a dangling .build-id symlink, which is a real namcap
+# error (not just the empty-directory warning it looks like) — there is no
+# debug info in this release binary for the machinery to have extracted in
+# the first place.
 options=('!strip' '!debug')
 # Tauri names the asset after `productName` verbatim ("Triple-C"), not the
 # lowercase Cargo binary name — verified against the real release, not
@@ -68,7 +72,14 @@ package() {
   # this app carries no separate resource directory under usr/lib/, so there
   # is nothing that could disagree between Debian's and Arch's package trees
   # for it to land in the wrong place.
-  ar x "Triple-C_${pkgver}_amd64.deb"
+  #
+  # Globbed rather than named literally: the publish workflow discovers the
+  # real asset name from the release itself specifically so a Tauri bundler
+  # naming change can't silently break this — naming the file again here
+  # would throw that away and fail this one line with an opaque "No such
+  # file or directory" instead. `source=()` above guarantees exactly one
+  # `*_amd64.deb` entry, so the glob can only ever match that one file.
+  ar x ./*_amd64.deb
   tar xf data.tar.* -C "$pkgdir"
 
   install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"