Add schist-bin, the Schist image editor, to the fast ring

[IAmJSD]

Summary

• add schist-bin 0.11.0, the Schist layered image editor/viewer (PSD, Affinity and camera raw support), as a locally maintained package on the fast release ring
• build for x86_64 and aarch64 by re-wrapping the pacman-format payloads Schist's own release workflow publishes, so the builder does no compiling
• add an .omarchy/upstream.sh hook so bin/sync-upstream picks up new releases from GitHub's release API asset digests without downloading the payloads
• the PKGBUILD is the one Schist itself carries under packaging/linux/aur/schist-bin/, unchanged, so the two stay in step

Schist is developed by Infrawrench (https://github.com/Infrawrench/schist), and this package is maintained by its upstream author.

Provenance

• both release assets are pinned by SHA-256 in the PKGBUILD
• the pinned sums match GitHub's API digests for the assets and the sums of independently downloaded copies
• the hook refuses to sync when the release's asset names carry a different upstream package release number than the PKGBUILD's _relver, so it can never pin checksums against an asset name the build would then 404 on

Package validation

• clean makepkg build in an archlinux:base-devel container, installed with pacman -U
• packaged file list is identical to the upstream payload apart from the licence moving to usr/share/licenses/schist-bin/
• ELF is PIE, full RELRO with BIND_NOW, non-executable stack, no RPATH/RUNPATH; it is intentionally unstripped (options=(!strip)) so its build id matches upstream's Sentry symbolication
• namcap reports only the expected warnings: the dlopen'd runtime dependencies (fontconfig, wayland, vulkan) it cannot see, and the unstripped binary
• headless smoke run under Xvfb with the lavapipe Vulkan driver opened the editor window and stayed up
• bin/sync-upstream schist-bin reports no update at 0.11.0; with the PKGBUILD rolled back to 0.10.0 the hook reports 0.11.0 with the matching digests, and it exits non-zero on a _relver mismatch

🤖 Generated with Claude Code

[IAmJSD]

@dhh hey, from previous convo 👍

[dhh]

Pushed three commits on top of yours after a review of the package and the hook:

• vulkan-driver moves to optdepends. The builder runs makepkg -s --noconfirm, and in a fresh Arch container pacman satisfies that virtual package with nvidia-utils (315 MB, plus mesa and llvm-libs) for a package() that copies five files. The payload's own .PKGINFO omits it too, and Omarchy installs a Vulkan driver per machine. The PKGBUILD now diverges from packaging/linux/aur/schist-bin/PKGBUILD in exactly that hunk, so you may want to port it upstream.
• The hook is gone; the package is now a plain upstream declaration. The built-in GitHub provider gained a "digests": true mode that reads the SHA-256 digest the release API reports per asset, which is what the hook did. The asset templates hard-code -1-, so a payload re-cut under another release number fails the sync loudly, same as the hook's _relver guard.
• min_release_age: 24h, as mise-bin has. Fourteen releases in fourteen days is a lot to land on the fast ring within six hours of tagging. A maintainer can still ship inside the window with BYPASS_MIN_RELEASE_AGE=1 bin/sync-upstream schist-bin.

Verified: checksums match both the API digests and independently downloaded payloads, the provider reports 0.11.0 from a checkout rolled back to 0.10.0 and 0.10.0 under the 24h window, and bin/sync-upstream self-test passes with new coverage for the digest mode. The PR description's mention of an upstream.sh hook and an unchanged PKGBUILD is now out of date.

— 🤖 Claude, posting on behalf of @dhh

[IAmJSD]

Yep sure, will upstream those pkgbuild changes to the main project too