fix(void): build the xbps release from the tag, not an attached sdist

The signed Void release depended on a fork sdist attached to the release
before the tag existed, and the app template carried a PENDING checksum that
had to be filled by hand. Every release is now built from its tag alone:

- packaging/void/build-release.sh is the one release path. The Gitea workflow,
  the local dry run and the smoke gate all call it.
- The canonical reproducible sdist is built from the tag with
  scripts/build_reproducible_wheel.py (Python 3.11, pinned uv).
- render-voculinux.sh pins version, _tag and checksum in the container's build
  tree only, and places the sdist where xbps-src resolves its distfile.
  The committed template keeps a zero placeholder until the post-release
  checksum pull request.
- xbps version is __version__ with the hyphen removed (0.19.0-beta becomes
  0.19.0beta), which xbps sorts below the final release.
- Builds run without the key; signing runs with the key mounted read-only and
  no network; the install smoke runs in a clean image without the key.
- The workflow gates the tag and the key before any container starts, writes
  the key to a 0600 tmpfs file, and publishes only the staged set (sdist,
  packages, signatures, repodata, client key).
- smoke.sh runs the same pipeline with a throwaway key.

packaging/void/srcpkgs/voculinux/template

@@ -2,6 +2,10 @@
 pkgname=voculinux
 version=0.18.5
 revision=1
+# The release tag this template names: v + __version__, with the pre-release
+# hyphen kept (the tag is v0.19.0-beta while version is 0.19.0beta). The release
+# gate (packaging/void/build-release.sh check-tag) refuses any mismatch.
+_tag=v0.18.5
 # The release sdist ships no setup.py (setuptools pyproject-only), so the
 # build goes through the PEP 517 wheel (cf. Solaar, PhotoCollage).
 build_style=python3-pep517
@@ -16,12 +20,12 @@ short_desc="Free, offline voice dictation for Linux"
 maintainer="Xavier Karma <xavier@bongbetic.com>"
 license="AGPL-3.0-only"
 homepage="https://git.bongbetic.com/xavierk/voculinux"
-distfiles="https://git.bongbetic.com/xavierk/voculinux/releases/download/v${version}/voculinux-${version}.tar.gz"
-# Pending: set to the sha256 of voculinux-${version}.tar.gz once the fork's
-# v${version} release exists (see packaging/void/README.md, "Checksum").
-# Until then xbps-src fails closed on this value; it never falls back to the
-# upstream archive.
-checksum=PENDING_FORK_RELEASE_SHA256
+distfiles="https://git.bongbetic.com/xavierk/voculinux/releases/download/${_tag}/voculinux-${version}.tar.gz"
+# sha256 of that release sdist. Recorded here by the post-release pull request
+# after each release. Until the first fork release it is a placeholder that is
+# never a real digest: every release build replaces it, in its build tree only,
+# with the digest of the sdist it builds (packaging/void/render-voculinux.sh).
+checksum=0000000000000000000000000000000000000000000000000000000000000000
 
 post_install() {
 	# The fork's sdist already names the desktop entry, icons and launchers