desktop: prebuilt pacman package + verified .deb (tasks 2022, 2074)

Native packages the installer can actually fetch, before task 2014 wires up
the fetching.

Arch (task 2022, re-scoped): the source PKGBUILD is gone — asking every user
to install rust+node and compile for minutes isn't distribution. Replaced by
desktop/packaging/arch/package-prebuilt.sh, which wraps the binary the Linux
job already built into a .pkg.tar.zst. No second Rust build, no Arch CI image:
the binary bundles nothing and resolves webkit/gtk/soup by soname, identical
on both distros, with SQLite compiled in and glibc used in the safe
built-old/run-new direction. CI is Debian and has no pacman, so the step logs
.PKGINFO plus the full file listing for audit instead of pretending to verify.

Debian (task 2074): install.sh hands the .deb to every Debian/Ubuntu user and
nothing had ever inspected it. tauri.conf.json now declares
libwebkit2gtk-4.1-0 + libgtk-3-0 explicitly rather than trusting inference —
and deliberately declares no appindicator or sqlite dep, since tauri is built
with features=[] and rusqlite is "bundled". desktop/packaging/deb/verify.sh
prints the generated control file, cross-checks it against what the ELF
actually needs via dpkg-shlibdeps, confirms every declared dep exists in apt,
and clean-container installs when a docker CLI is available.

Both artifacts join the run artifact and the tagged release; install.sh grows
a pacman branch so Arch/CachyOS gets a native install instead of the AppImage
fallback. Still no release cut (rule 2).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/packaging/install.sh

@@ -6,8 +6,9 @@
 #
 # Fetches the LATEST published release for this machine's architecture and
 # installs it, ending with a working app + menu entry. Native-first:
-#   * Debian/Ubuntu (dpkg+apt) -> the native .deb (system libs; needs sudo).
-#   * everything else (Arch/CachyOS/Fedora/…) -> the de-bundled AppImage,
+#   * Arch/CachyOS (pacman)     -> the native .pkg.tar.zst (system libs; needs sudo).
+#   * Debian/Ubuntu (dpkg+apt)  -> the native .deb (system libs; needs sudo).
+#   * everything else (Fedora/openSUSE/…) -> the de-bundled AppImage,
 #     installed user-locally (no sudo). The AppImage's graphics libs are
 #     stripped in CI (see debundle-graphics.sh), so it uses the host GPU stack
 #     and renders where a stock Tauri AppImage would black-window (issue 2021).
@@ -45,25 +46,52 @@ json="$(curl -fsSL "$API/releases/latest" 2>/dev/null)" || die \
 # .AppImage/.deb URLs present are the asset download links.
 appimage_url="$(printf '%s' "$json" | grep -oE 'https?://[^"]+\.AppImage' | head -1 || true)"
 deb_url="$(printf '%s' "$json" | grep -oE 'https?://[^"]+\.deb' | head -1 || true)"
+pkg_url="$(printf '%s' "$json" | grep -oE 'https?://[^"]+\.pkg\.tar\.[a-z]+' | head -1 || true)"
 version="$(printf '%s' "$json" | grep -oE '"tag_name":"[^"]+"' | head -1 | sed -E 's/.*:"([^"]+)".*/\1/')"
-[ -n "$appimage_url" ] || [ -n "$deb_url" ] || die "the latest release has no installable Linux asset."
+[ -n "$appimage_url" ] || [ -n "$deb_url" ] || [ -n "$pkg_url" ] ||
+  die "the latest release has no installable Linux asset."
 say "Latest release: ${version:-unknown}"
 
 tmp="$(mktemp -d)"
 trap 'rm -rf "$tmp"' EXIT INT TERM
 
+# Both native paths install system-wide, so they need root. Resolved once here
+# rather than duplicated per branch; the AppImage path below never calls this.
+need_root() {
+  if [ "$(id -u)" -eq 0 ]; then sudo=""; else
+    have sudo || die "a native install needs root; re-run as root or install sudo."
+    sudo="sudo"
+  fi
+  say "Installing (you may be prompted for your password)…"
+}
+
+# --- native pacman path (Arch/CachyOS/Manjaro) ------------------------------
+# Preferred over the AppImage on Arch: pacman pulls webkit2gtk-4.1 itself and the
+# app then runs against the host graphics stack, which is what keeps the
+# EGL_BAD_PARAMETER black window (issue 2021) from coming back. It also means the
+# app is tracked by the package manager and uninstalls cleanly.
+if have pacman && [ -n "$pkg_url" ]; then
+  say "Arch-family system detected — installing the native pacman package"
+  # Keep the published filename: pacman -U expects a *.pkg.tar.* name and refuses
+  # a file that doesn't look like a package, whatever its actual contents.
+  pkg_file="$tmp/$(basename "$pkg_url")"
+  curl -fSL -o "$pkg_file" "$pkg_url"
+  need_root
+  $sudo pacman -U --noconfirm "$pkg_file"
+  say "Done. Launch ThoughtSync from your application menu, or run thoughtsync."
+  exit 0
+fi
+
 # --- native .deb path (Debian/Ubuntu) ---------------------------------------
 if have dpkg && have apt-get && [ -n "$deb_url" ]; then
   say "Debian-family system detected — installing the native .deb"
   curl -fSL -o "$tmp/thoughtsync.deb" "$deb_url"
-  if [ "$(id -u)" -eq 0 ]; then sudo=""; else
-    have sudo || die "installing the .deb needs root; re-run as root or install sudo."
-    sudo="sudo"
-  fi
-  say "Installing (you may be prompted for your password)…"
-  # apt-get resolves the .deb's dependencies (webkit2gtk etc.); dpkg is the
-  # fallback if this apt is too old for local-file installs.
-  $sudo apt-get install -y "$tmp/thoughtsync.deb" || $sudo dpkg -i "$tmp/thoughtsync.deb"
+  need_root
+  # apt-get resolves the .deb's dependencies (webkit2gtk etc.). dpkg is the
+  # fallback if this apt is too old for local-file installs — it leaves the deps
+  # unconfigured, so `apt-get -f install` is what actually completes that path.
+  $sudo apt-get install -y "$tmp/thoughtsync.deb" ||
+    { $sudo dpkg -i "$tmp/thoughtsync.deb" || true; $sudo apt-get -f install -y; }
   say "Done. Launch ThoughtSync from your application menu."
   exit 0
 fi