desktop: prebuilt pacman package + verified .deb (tasks 2022, 2074)

Native packages the installer can actually fetch, before task 2014 wires up
the fetching.

Arch (task 2022, re-scoped): the source PKGBUILD is gone — asking every user
to install rust+node and compile for minutes isn't distribution. Replaced by
desktop/packaging/arch/package-prebuilt.sh, which wraps the binary the Linux
job already built into a .pkg.tar.zst. No second Rust build, no Arch CI image:
the binary bundles nothing and resolves webkit/gtk/soup by soname, identical
on both distros, with SQLite compiled in and glibc used in the safe
built-old/run-new direction. CI is Debian and has no pacman, so the step logs
.PKGINFO plus the full file listing for audit instead of pretending to verify.

Debian (task 2074): install.sh hands the .deb to every Debian/Ubuntu user and
nothing had ever inspected it. tauri.conf.json now declares
libwebkit2gtk-4.1-0 + libgtk-3-0 explicitly rather than trusting inference —
and deliberately declares no appindicator or sqlite dep, since tauri is built
with features=[] and rusqlite is "bundled". desktop/packaging/deb/verify.sh
prints the generated control file, cross-checks it against what the ELF
actually needs via dpkg-shlibdeps, confirms every declared dep exists in apt,
and clean-container installs when a docker CLI is available.

Both artifacts join the run artifact and the tagged release; install.sh grows
a pacman branch so Arch/CachyOS gets a native install instead of the AppImage
fallback. Still no release cut (rule 2).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

.forgejo/workflows/desktop.yml

@@ -78,6 +78,24 @@ jobs:
       - name: De-bundle AppImage graphics libraries
         run: bash desktop/packaging/appimage/debundle-graphics.sh
 
+      # install.sh hands the .deb to every Debian/Ubuntu user, so the package's
+      # Depends must be right BEFORE a release exists. Prints the generated
+      # control file and cross-checks it against what the ELF actually needs
+      # (dpkg-shlibdeps). tauri.conf.json declares libwebkit2gtk-4.1-0 + libgtk-3-0
+      # explicitly rather than trusting inference alone; there's deliberately no
+      # appindicator or sqlite dep (tauri features = [], rusqlite is "bundled").
+      - name: Verify the .deb
+        run: bash desktop/packaging/deb/verify.sh
+
+      # Repackage the binary just built into a native pacman package, so Arch /
+      # CachyOS gets a real native install from install.sh instead of the AppImage
+      # fallback — without a second Rust build or an Arch CI image. Safe because
+      # nothing is bundled: the binary resolves webkit/gtk by soname, which is
+      # identical across the two distros. Can't be pacman-tested here (Debian
+      # runner), so the step logs .PKGINFO + the full file listing for audit.
+      - name: Package for Arch (pacman)
+        run: bash desktop/packaging/arch/package-prebuilt.sh
+
       # Make the built .deb + .AppImage downloadable from the run (for hand-testing).
       # continue-on-error: the Forgejo artifact backend may not be configured yet; a
       # failed upload must not fail the build itself.
@@ -91,6 +109,7 @@ jobs:
           path: |
             desktop/src-tauri/target/release/bundle/appimage/*.AppImage
             desktop/src-tauri/target/release/bundle/deb/*.deb
+            desktop/src-tauri/target/release/bundle/arch/*.pkg.tar.*
           if-no-files-found: warn
 
       # Tag builds only: publish a real, versioned Fabled-Git Release with the