release: AUR packaging (hoverfly + hoverfly-bin) [draft — AUR regs closed]

[v1rtl]

Summary

Adds AUR packaging so Arch users can install hoverfly via an AUR helper. Ships the standard Arch dual-package setup:

• hoverfly-bin — installs the official prebuilt release tarball (x86_64 + aarch64), verified by sha256. No compilation, instant install.
• hoverfly — builds from the GitHub source tarball with cargo build --frozen (native CLI, stable toolchain; nightly is wasm-only).

Both declare provides=('hoverfly') / conflicts so only one installs at a time.

How it works

• packaging/aur/{hoverfly,hoverfly-bin}/PKGBUILD are templates with a @PKGVER@ marker and SKIP checksums.
• A new publish-aur job in release.yml (runs after build) stamps the release version into each PKGBUILD and publishes via KSXGitHub/github-actions-deploy-aur@v4.1.3 with updpkgsums: true — the action computes the real sha256 sums from the release/source tarballs, regenerates .SRCINFO, and pushes to the AUR.
• The job is gated on AUR_SSH_PRIVATE_KEY: if the secret isn't set it skips with a notice rather than failing the release. So merging this is safe even before the AUR account exists.

Why draft

AUR registrations are currently closed, so the one-time setup below can't be completed yet. This PR is parked as a draft until registrations reopen. Nothing in it affects existing releases (the AUR job no-ops without the secret).

One-time setup required before this goes live

1. Create an AUR account + register an SSH key.
2. Initial submission of both packages (hoverfly, hoverfly-bin) to the AUR (first push must be done by the account owner).
3. Add repo secrets: AUR_USERNAME, AUR_EMAIL, AUR_SSH_PRIVATE_KEY.

Note: AUR auth uses an SSH key (not a GPG package-signing key) and there's no repo to host — so this avoids the GPG key-management work that apt/dnf repos would require.

Notes

• No new build targets — -bin reuses the existing x86_64/aarch64 Linux release tarballs.
• PKGBUILDs pass bash -n; release.yml is valid YAML.