desktop: prebuilt pacman package + verified .deb (tasks 2022, 2074)

Native packages the installer can actually fetch, before task 2014 wires up
the fetching.

Arch (task 2022, re-scoped): the source PKGBUILD is gone — asking every user
to install rust+node and compile for minutes isn't distribution. Replaced by
desktop/packaging/arch/package-prebuilt.sh, which wraps the binary the Linux
job already built into a .pkg.tar.zst. No second Rust build, no Arch CI image:
the binary bundles nothing and resolves webkit/gtk/soup by soname, identical
on both distros, with SQLite compiled in and glibc used in the safe
built-old/run-new direction. CI is Debian and has no pacman, so the step logs
.PKGINFO plus the full file listing for audit instead of pretending to verify.

Debian (task 2074): install.sh hands the .deb to every Debian/Ubuntu user and
nothing had ever inspected it. tauri.conf.json now declares
libwebkit2gtk-4.1-0 + libgtk-3-0 explicitly rather than trusting inference —
and deliberately declares no appindicator or sqlite dep, since tauri is built
with features=[] and rusqlite is "bundled". desktop/packaging/deb/verify.sh
prints the generated control file, cross-checks it against what the ELF
actually needs via dpkg-shlibdeps, confirms every declared dep exists in apt,
and clean-container installs when a docker CLI is available.

Both artifacts join the run artifact and the tagged release; install.sh grows
a pacman branch so Arch/CachyOS gets a native install instead of the AppImage
fallback. Still no release cut (rule 2).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/packaging/arch/README.md

@@ -1,31 +1,60 @@
 # ThoughtSync desktop — Arch package
 
-A native Arch/pacman package, built **from source** so it links against your
-**system** libraries (webkit2gtk-4.1 + your GPU driver). This is the robust install
-on Arch/CachyOS: it avoids the bundled-AppImage `EGL_BAD_PARAMETER` black-window
-problem entirely, and it installs a proper application-menu entry.
+A **prebuilt** native pacman package (`.pkg.tar.zst`), published as an asset on
+every ThoughtSync release. Nothing to compile, no toolchain to install.
+
+Installing natively on Arch matters for more than tidiness: pacman pulls
+`webkit2gtk-4.1` itself and the app runs against your system's graphics stack,
+which is what keeps the bundled-library `EGL_BAD_PARAMETER` black window
+(issue 2021) from coming back. It also means the app is package-manager tracked
+and uninstalls cleanly.
 
 ## Install
 
-From a clone of the `thoughtsync` repo:
+Easiest — the one-command installer picks this package automatically on any
+pacman system:
 
 ```sh
-cd desktop/packaging/arch
-makepkg -si
+curl -fsSL https://git.fabledsword.com/bvandeusen/thoughtsync/raw/branch/main/desktop/packaging/install.sh | sh
 ```
 
-`makepkg` will pull the build tools (`rust`, `nodejs`, `npm`) and runtime deps
-(`webkit2gtk-4.1`, `gtk3`, …) via pacman, compile the frontend + the Rust binary,
-and install:
+Or grab the `.pkg.tar.zst` from the
+[latest release](https://git.fabledsword.com/bvandeusen/thoughtsync/releases/latest)
+and install it directly:
+
+```sh
+sudo pacman -U thoughtsync-desktop-*-x86_64.pkg.tar.zst
+```
+
+Either way you get:
 
 - `/usr/bin/thoughtsync` — the app
 - `/usr/share/applications/thoughtsync.desktop` — the menu entry
-- `/usr/share/pixmaps/thoughtsync.png` — the icon
+- `/usr/share/icons/hicolor/*/apps/thoughtsync.png` — themed icons
 
-Then launch **ThoughtSync** from your app menu (or run `thoughtsync`).
+Launch **ThoughtSync** from your app menu, or run `thoughtsync`.
 
-## Notes
+Uninstall: `sudo pacman -R thoughtsync-desktop`.
 
-- Builds in-place from the checkout (`makepkg` reads the committed state via git).
-- The compile takes a few minutes the first time (Rust release build).
-- Uninstall: `sudo pacman -R thoughtsync-desktop`.
+## How the package is built
+
+`package-prebuilt.sh` runs in CI (`.forgejo/workflows/desktop.yml`) and wraps the
+binary the Linux build already produced into a pacman package — it does not
+compile anything a second time.
+
+Packaging a Debian-compiled binary for Arch is safe here because the binary
+bundles nothing: it resolves `libwebkit2gtk-4.1.so.0`, `libgtk-3.so.0` and
+`libsoup-3.0.so.0` by SONAME at runtime and those are identical on both distros,
+SQLite is compiled in (`rusqlite` "bundled"), and glibc's forward compatibility
+means building on Debian's older glibc and running on Arch's newer one is the
+safe direction.
+
+CI is Debian and has no `pacman`, so it cannot install-test the result. The build
+step instead logs the package's `.PKGINFO` and complete file listing, so the
+package is auditable from the run log; a real `pacman -U` is the final proof.
+
+## Previously
+
+This directory used to hold a source-build `PKGBUILD` requiring `makepkg -si`
+with `rust` + `nodejs` + `npm` installed. It was removed once prebuilt packages
+shipped — asking every user to install a compiler toolchain isn't distribution.