fix(void): carry python3-pysocks and constrain the audio and SOCKS floors

Void's stock python3-PyAudio (0.2.12_5) and python3-pysocks (1.7.0_8) sit
below the project floors (pyaudio>=0.2.13, PySocks>=1.7.1). voculinux
depended on both by bare name, which an installed stock package already
satisfies, so a user who had the stock packages was never upgraded.

- add packaging/void/srcpkgs/python3-pysocks: PySocks 1.7.1 from the PyPI
  sdist that uv.lock pins (sha256 3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0)
- voculinux depends on python3-PyAudio>=0.2.14_1 and python3-pysocks>=1.7.1_1
- the install smoke installs the stock packages first, then voculinux, and
  fails unless each reads back as its carried pkgver
- tests: each constraint must name its carried template's current version
  and revision; the stock version must sit below the floor; the depends
  parser refuses malformed tokens instead of stripping them
- docs: "Version floors" in packaging/void/README.md; a pointer in
  docs/RELEASE_PROCESS.md

Refs #16

packaging/void/README.md

@@ -21,6 +21,7 @@ packaging/void/
     ├── python3-pywhispercpp/  ticket #26: whisper.cpp Python binding
     ├── python3-pynput/        ticket #25: the input library Void does not ship
     ├── python3-PyAudio/       ticket #25: the audio binding, updated past Void's copy
+    ├── python3-pysocks/       spec #16 gap: the SOCKS module, updated past Void's copy
     └── voculinux              ticket #27: the application
 ```
 
@@ -33,9 +34,45 @@ packaging/void/
 | Template | Ticket | Notes |
 |---|---|---|
 | `python3-pywhispercpp` | #26 | Vulkan backend on by default; see below |
-| `python3-pynput`, `python3-PyAudio` | #25 | Dependencies Void does not ship at the needed version |
+| `python3-pynput` | #25 | A dependency Void does not ship |
+| `python3-PyAudio`, `python3-pysocks` | spec #16 gap | Void's copies are below the project floors; see [Version floors](#version-floors) |
 | `voculinux` | #27 | The app, from the canonical release sdist; see below |
 
+## Version floors
+
+`pyproject.toml` declares floors that Void's own packages do not meet. On
+2026-11-06 the stock packages on void-packages master were:
+
+| Package | Stock Void | Project floor | Carried template | `voculinux` depends |
+|---|---|---|---|---|
+| `python3-PyAudio` | 0.2.12_5 | `pyaudio>=0.2.13` | 0.2.14_1 | `python3-PyAudio>=0.2.14_1` |
+| `python3-pysocks` | 1.7.0_8 | `PySocks>=1.7.1,<2` | 1.7.1_1 | `python3-pysocks>=1.7.1_1` |
+
+The gap is closed in the personal repository, not hidden. The carried
+templates build the versions `uv.lock` pins, and `voculinux` names each one
+with a `>=` constraint in the xbps `name>=version_revision` form (the xbps-src
+manual lists `<`, `>`, `<=` and `>=`). A bare name would be satisfied by the
+stock package a user already has, so xbps would leave it in place and the app
+would run below its floor. With the constraint, xbps takes the carried
+template from the signed repository instead. Dependency verification stays on.
+
+The install smoke checks the upgrade, not just a clean install: it installs
+the stock packages from Void first, then `voculinux`, and fails unless each
+package reads back as its carried pkgver.
+`tests/test_void_app_template.py` requires every constraint to name its
+template's current version and revision, so a template bump without a
+`depends` bump fails offline. `tests/test_void_small_deps.py` requires the
+stock version below the floor and the carried version at or above it.
+
+Known limit: xbps has one comparator per dependency, so PySocks' `<2` cannot
+be written. The carried 1.7.1 satisfies it. A future Void `python3-pysocks`
+2.x would also satisfy `>=1.7.1_1`, so it is not excluded by the dependency.
+
+When a project floor rises, or Void's stock package reaches the floor, change
+the carried template and its constraint in the same pull request. The
+stock-below-floor test fails once Void catches up, which is the signal to
+retire the carried template deliberately.
+
 ## python3-pywhispercpp
 
 Version `1.5.0`, pinned to the same version `install.sh`
@@ -70,9 +107,11 @@ upstream. Read [Version mapping](#version-mapping) and [Checksum](#checksum)
 before changing `version`, `_tag` or `checksum`.
 
 - **Runtime deps** are Void's own interpreter, GTK and desktop bindings,
-  the packaged Python libraries, the three templates from tickets #25
-  and #26 (`python3-pynput`, `python3-PyAudio`, `python3-pywhispercpp`),
-  and the helper tools the app shells out to: PipeWire (capture), `wtype`
+  the packaged Python libraries, the carried templates (`python3-pynput`,
+  `python3-PyAudio`, `python3-pysocks` and `python3-pywhispercpp`; the audio
+  binding and SOCKS module are version-constrained, see
+  [Version floors](#version-floors)), and the helper tools the app shells
+  out to: PipeWire (capture), `wtype`
   (direct typing on niri), `wl-clipboard`, `xdotool` and
   `pulseaudio-utils`. `ibus` is not a dependency: it cannot inject on
   niri. Every name was verified to exist in current void-packages; the
@@ -156,11 +195,14 @@ host Void install and nothing is published. Stages, in order, each fails the run
    with `xlint`, built with `xbps-src`, the sdist resolved by `xbps-src show`;
 4. `sign`: the packages indexed and signed, with no network;
 5. `install`: in a clean image with no key, an unsigned install is refused, the
-   signed repository is trusted, `voculinux` installs, `voculinux --version`
-   shows the version, the payload checks pass (desktop entry, icon, marker, no
-   models, no pre-rename names, the Vulkan backend, no host-native CPU tuning),
-   and the imports load (`pynput` through its dummy backend, `evdev`, `gi` with
-   Gtk 3, `pywhispercpp.model`, `pyaudio`, and the app's own modules, which keep their retained internal name).
+   signed repository is trusted, Void's stock `python3-PyAudio` and
+   `python3-pysocks` are installed, then `voculinux` installs and upgrades both
+   to the carried versions (see [Version floors](#version-floors)),
+   `voculinux --version` shows the version, the payload checks pass (desktop
+   entry, icon, marker, no models, no pre-rename names, the Vulkan backend, no
+   host-native CPU tuning), and the imports load (`pynput` through its dummy
+   backend, `evdev`, `gi` with Gtk 3, `pywhispercpp.model`, `pyaudio`, `socks`,
+   and the app's own modules, which keep their retained internal name).
 
 `tests/test_void_smoke_gate.py` asserts offline that the gate stays wired to
 every `srcpkgs` template.