gearlever-bin, bottles-bin: bundle AUR-only dependencies

gearlever-bin: ship ftputil + desktop-entry-lib inside /usr/share/gearlever
(pinned via upstream requirements.txt) instead of depending on the AUR
packages.

bottles-bin: build the fvs2 CLI (with its core library) from source and
bundle it under /usr/lib/bottles (Bottles patched to use that path), and
ship patool, pathvalidate and vkbasalt-cli in /usr/share/bottles. vkbasalt
becomes an optdepend. Installing either package now needs no AUR builds.

gearlever-bin/.SRCINFO

@@ -1,7 +1,7 @@
 pkgbase = gearlever-bin
 	pkgdesc = Manage AppImages with ease (prebuilt)
 	pkgver = 4.6.2
-	pkgrel = 1
+	pkgrel = 2
 	url = https://gearlever.mijorus.it
 	arch = any
 	license = GPL-3.0-or-later
@@ -15,8 +15,6 @@ pkgbase = gearlever-bin
 	depends = python-dbus
 	depends = python-requests
 	depends = python-pyxdg
-	depends = python-ftputil
-	depends = python-desktop-entry-lib
 	depends = 7zip
 	depends = binutils
 	depends = squashfs-tools
@@ -26,6 +24,6 @@ pkgbase = gearlever-bin
 	provides = gearlever
 	conflicts = gearlever
 	source = https://github.com/Felitendo/PKGBUILDS/releases/download/gearlever-bin-4.6.2/gearlever-bin-4.6.2.tar.zst
-	sha256sums = 319841a5dffd942b6f3b86822ac4d9d52a5b4ee559ea03ee5c2a6318a5161546
+	sha256sums = 225dd08d1fbdf33bb5979660737cee180f60b8cfa6477f1553025a6c2f5236a5
 
 pkgname = gearlever-bin

gearlever-bin/PKGBUILD

@@ -4,21 +4,20 @@
 
 pkgname=gearlever-bin
 pkgver=4.6.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Manage AppImages with ease (prebuilt)"
 arch=('any')
 url="https://gearlever.mijorus.it"
 license=('GPL-3.0-or-later')
 depends=('gtk4' 'libadwaita' 'glib2' 'dconf' 'hicolor-icon-theme' 'python'
          'python-gobject' 'python-dbus' 'python-requests' 'python-pyxdg'
-         'python-ftputil' 'python-desktop-entry-lib'
          '7zip' 'binutils' 'squashfs-tools' 'fuse2')
 optdepends=('dwarfs: extract AppImages that use a DwarFS filesystem'
             'libxml2-legacy: required by the LibreOffice AppImage')
 provides=('gearlever')
 conflicts=('gearlever')
 source=("https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
-sha256sums=('319841a5dffd942b6f3b86822ac4d9d52a5b4ee559ea03ee5c2a6318a5161546')
+sha256sums=('225dd08d1fbdf33bb5979660737cee180f60b8cfa6477f1553025a6c2f5236a5')
 
 package() {
   cp -a "$srcdir/usr" "$pkgdir/"

gearlever-bin/pkg.sh

@@ -8,7 +8,7 @@
 UPSTREAM_REPO="mijorus/gearlever"
 
 # Installed in CI (pacman) before build_artifact runs.
-BUILD_DEPS=(meson ninja glib2 glib2-devel python gettext)
+BUILD_DEPS=(meson ninja glib2 glib2-devel python gettext python-pip)
 
 latest_version() {
   # gh instead of curl: unauthenticated GitHub API calls are rate-limited on
@@ -43,6 +43,15 @@ build_artifact() {
   # files themselves into the install tree.
   find "$destdir" -name meson.build -delete
 
+  # ftputil and desktop-entry-lib are AUR-only; bundle them (pure python)
+  # into the app's module dir, which the launcher puts on sys.path. Versions
+  # come from upstream's requirements.txt pins.
+  grep -E '^(ftputil|desktop-entry-lib)' "$srctree/requirements.txt" > "$workdir/bundle-reqs.txt"
+  [[ "$(wc -l < "$workdir/bundle-reqs.txt")" -eq 2 ]] || { echo "expected 2 pinned bundle deps in requirements.txt" >&2; return 1; }
+  python -m pip install --isolated --no-deps --target "$destdir/usr/share/gearlever" \
+    -r "$workdir/bundle-reqs.txt"
+  rm -rf "$destdir/usr/share/gearlever/bin"
+
   # These caches are generated by pacman hooks; shipping them would cause
   # file conflicts on install.
   rm -f "$destdir/usr/share/glib-2.0/schemas/gschemas.compiled" \