scripts: add an AUR_PUBLISH opt-out, and clean up .tar.bz2 sources

A package can now be prepared in this repository before it goes public:
pkg.sh sets AUR_PUBLISH=false and steps 1-4 run as usual, so the PKGBUILD
is kept current and test-built while the publishing waits.

.tar.bz2 joins the archive types the run cleans up and gitignores; concat
carries one as a source.

scripts/update-package.sh

@@ -5,7 +5,8 @@
 #      refresh_checksums update the sums
 #   3. if the PKGBUILD changed: set pkgrel and run a makepkg test build
 #   4. regenerate .SRCINFO and commit changes back to this repository
-#   5. push the package files to the AUR if it differs
+#   5. push the package files to the AUR if it differs, unless the package
+#      opts out with AUR_PUBLISH=false
 #
 # Every package sources deliverables published by upstream - the AUR does not
 # allow a PKGBUILD to pull in a binary tarball built by the maintainer, so
@@ -27,6 +28,10 @@ if [[ "${CI:-}" == "true" ]]; then
 fi
 
 BUILD_DEPS=()
+# A package can be kept out of the AUR while it is still being prepared here:
+# pkg.sh sets AUR_PUBLISH=false and everything up to step 4 runs as usual, so
+# the PKGBUILD stays current and test-built - only the publishing waits.
+AUR_PUBLISH=true
 source "$pkg/pkg.sh"
 
 ver="$(latest_version || true)"
@@ -89,7 +94,8 @@ mv "$pkg/.SRCINFO.new" "$pkg/.SRCINFO"
 
 # drop downloaded sources and build leftovers (all gitignored, never tracked)
 rm -rf "$pkg/src" "$pkg/pkg"
-rm -f "$pkg"/*.pkg.tar.* "$pkg"/*.tar.zst "$pkg"/*.tar.gz "$pkg"/*.deb "$pkg"/*.AppImage
+rm -f "$pkg"/*.pkg.tar.* "$pkg"/*.tar.zst "$pkg"/*.tar.gz "$pkg"/*.tar.bz2 \
+      "$pkg"/*.deb "$pkg"/*.AppImage
 
 ### 4: commit back to this repository ########################################
 
@@ -112,6 +118,11 @@ fi
 
 ### 5: push to the AUR #######################################################
 
+if [[ "$AUR_PUBLISH" != true ]]; then
+  echo "$pkg: AUR_PUBLISH is off - kept up to date here, not published to the AUR"
+  exit 0
+fi
+
 if [[ -z "${AUR_SSH_PRIVATE_KEY:-}" ]]; then
   echo "::error::$pkg: AUR_SSH_PRIVATE_KEY is not set - cannot push to the AUR." \
        "Add your AUR SSH private key as a repository secret named AUR_SSH_PRIVATE_KEY."