feat(ci): gate AUR PKGBUILD builds on every PR (#772)

* feat(ci): gate AUR PKGBUILD builds on every PR

Nothing ever ran makepkg on the PKGBUILD before a tag pushed it to AUR
users, and the channel broke twice that way (#736, #757) — a PKGBUILD
change did not even start a CI job, because no paths filter matched
packaging/aur/**.

The gate (packaging/aur/build-test.sh, run in archlinux:latest — the
AUR is a rolling channel, so the image stays deliberately unpinned):

- swaps the tag-archive source= for a git archive of the checkout under
  the same filename and prefix, so build()/package() run unchanged and
  the gate answers "does this commit build on Arch"
- installs depends/makedepends from the repos; python-pywhispercpp
  (virtual, provided by the AUR backends, #579) and python-pynput (AUR)
  are satisfied by a stub so makepkg still verifies the full depends
  set, and pip-installed from the hash-pinned requirements/runtime.txt
  for the import smoke
- runs namcap on the PKGBUILD and the built package, failing on errors
  only (its warnings are noise around lazy imports and virtual depends)
- installs the package and imports the whole UI/recognition stack, plus
  the vocalinux --version entry point

Part of #701 (phase 6).

* fix(ci): stop partial-upgrading in the AUR gate and correct the #736 attribution

.github/workflows/unified-pipeline.yml

@@ -23,6 +23,7 @@ jobs:
     outputs:
       web: ${{ steps.filter.outputs.web }}
       python: ${{ steps.filter.outputs.python }}
+      aur: ${{ steps.filter.outputs.aur }}
       deploy_website: ${{ steps.deploy_check.outputs.deploy }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -52,6 +53,14 @@ jobs:
               - 'justfile'
               - '.pre-commit-config.yaml'
               - '.github/workflows/unified-pipeline.yml'
+            # The AUR gate builds packaging/aur/vocalinux/PKGBUILD from this
+            # tree. Its depends= mirror pyproject.toml, so every python change
+            # reaches the gate through the python filter above; this filter
+            # exists so a PKGBUILD-only change runs the gate without dragging
+            # the whole python matrix along.
+            aur:
+              - 'packaging/aur/**'
+              - '.github/workflows/unified-pipeline.yml'
       - name: Check if website should deploy
         id: deploy_check
         env:
@@ -307,6 +316,28 @@ jobs:
             "${{ matrix.distro }}" \
             bash /pk/boot-test.sh "/dist/$(basename "$APPIMAGE")"
 
+  # Nothing built the PKGBUILD before a tag pushed it to AUR users, which is
+  # how #757 shipped: Arch's setuptools 84 against our old <82 cap. The gate
+  # swaps the not-yet-existing tag tarball for a git archive of the checkout,
+  # so it answers whether *this commit* builds on Arch. Deliberately
+  # archlinux:latest: the AUR is a rolling channel and #757 was Arch moving
+  # under us.
+  aur-build-test:
+    name: 🏛️ Build AUR package (gate)
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.aur == 'true'
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build the PKGBUILD on Arch
+        run: |
+          docker run --rm \
+            -v "$PWD:/repo:ro" \
+            archlinux:latest \
+            bash /repo/packaging/aur/build-test.sh
+
   web-build:
     name: 🌐 Build Website
     runs-on: ubuntu-latest