gearlever-bin, bottles-bin: bundle AUR-only dependencies

gearlever-bin: ship ftputil + desktop-entry-lib inside /usr/share/gearlever
(pinned via upstream requirements.txt) instead of depending on the AUR
packages.

bottles-bin: build the fvs2 CLI (with its core library) from source and
bundle it under /usr/lib/bottles (Bottles patched to use that path), and
ship patool, pathvalidate and vkbasalt-cli in /usr/share/bottles. vkbasalt
becomes an optdepend. Installing either package now needs no AUR builds.

gearlever-bin/pkg.sh

@@ -8,7 +8,7 @@
 UPSTREAM_REPO="mijorus/gearlever"
 
 # Installed in CI (pacman) before build_artifact runs.
-BUILD_DEPS=(meson ninja glib2 glib2-devel python gettext)
+BUILD_DEPS=(meson ninja glib2 glib2-devel python gettext python-pip)
 
 latest_version() {
   # gh instead of curl: unauthenticated GitHub API calls are rate-limited on
@@ -43,6 +43,15 @@ build_artifact() {
   # files themselves into the install tree.
   find "$destdir" -name meson.build -delete
 
+  # ftputil and desktop-entry-lib are AUR-only; bundle them (pure python)
+  # into the app's module dir, which the launcher puts on sys.path. Versions
+  # come from upstream's requirements.txt pins.
+  grep -E '^(ftputil|desktop-entry-lib)' "$srctree/requirements.txt" > "$workdir/bundle-reqs.txt"
+  [[ "$(wc -l < "$workdir/bundle-reqs.txt")" -eq 2 ]] || { echo "expected 2 pinned bundle deps in requirements.txt" >&2; return 1; }
+  python -m pip install --isolated --no-deps --target "$destdir/usr/share/gearlever" \
+    -r "$workdir/bundle-reqs.txt"
+  rm -rf "$destdir/usr/share/gearlever/bin"
+
   # These caches are generated by pacman hooks; shipping them would cause
   # file conflicts on install.
   rm -f "$destdir/usr/share/glib-2.0/schemas/gschemas.compiled" \