fix(void): build the xbps release from the tag, not an attached sdist (#37)

Every release is built from its tag alone by packaging/void/build-release.sh, shared by the tag workflow and local dry runs. Signs in a network-less container with the key mounted read-only and publishes to the tag release and the rolling latest release.

packaging/void/srcpkgs/voculinux/template

@@ -2,6 +2,10 @@
 pkgname=voculinux
 version=0.18.5
 revision=1
+# The release tag this template names: v + __version__, with the pre-release
+# hyphen kept (the tag is v0.19.0-beta while version is 0.19.0beta). The release
+# gate (packaging/void/build-release.sh check-tag) refuses any mismatch.
+_tag=v0.18.5
 # The release sdist ships no setup.py (setuptools pyproject-only), so the
 # build goes through the PEP 517 wheel (cf. Solaar, PhotoCollage).
 build_style=python3-pep517
@@ -16,12 +20,12 @@ short_desc="Free, offline voice dictation for Linux"
 maintainer="Xavier Karma <xavier@bongbetic.com>"
 license="AGPL-3.0-only"
 homepage="https://git.bongbetic.com/xavierk/voculinux"
-distfiles="https://git.bongbetic.com/xavierk/voculinux/releases/download/v${version}/voculinux-${version}.tar.gz"
-# Pending: set to the sha256 of voculinux-${version}.tar.gz once the fork's
-# v${version} release exists (see packaging/void/README.md, "Checksum").
-# Until then xbps-src fails closed on this value; it never falls back to the
-# upstream archive.
-checksum=PENDING_FORK_RELEASE_SHA256
+distfiles="https://git.bongbetic.com/xavierk/voculinux/releases/download/${_tag}/voculinux-${version}.tar.gz"
+# sha256 of that release sdist. Recorded here by the post-release pull request
+# after each release. Until the first fork release it is a placeholder that is
+# never a real digest: every release build replaces it, in its build tree only,
+# with the digest of the sdist it builds (packaging/void/render-voculinux.sh).
+checksum=0000000000000000000000000000000000000000000000000000000000000000
 
 post_install() {
 	# The fork's sdist already names the desktop entry, icons and launchers