scripts: add an AUR_PUBLISH opt-out, and clean up .tar.bz2 sources

A package can now be prepared in this repository before it goes public:
pkg.sh sets AUR_PUBLISH=false and steps 1-4 run as usual, so the PKGBUILD
is kept current and test-built while the publishing waits.

.tar.bz2 joins the archive types the run cleans up and gitignores; concat
carries one as a source.

.gitignore

@@ -1,6 +1,7 @@
 # makepkg build leftovers and downloaded/built artifacts
 *.tar.zst
 *.tar.gz
+*.tar.bz2
 *.pkg.tar.*
 */src/
 */pkg/