concat, concat-bin, concat-git: new packages

Concat (https://github.com/jub0t/Concat) is a Tauri 2 shell around a Rust
video engine, sold as a CapCut replacement. The project is mid-rename: the
binary, the desktop entry, the icons and the .deb asset all still say
WolfCut, so the packages install upstream's paths unchanged and add a
/usr/bin/concat symlink.

Upstream stages a static ffmpeg/ffprobe pair (180 MB) and whisper-cli
inside its bundle so the app runs on a machine with nothing installed.
Both lookups fall back to PATH, so concat-bin drops those two directories
and the source packages set WOLFCUT_SYSTEM_TOOLS=1 - the switch upstream
put in build.rs for exactly this case - leaving ffmpeg and whisper-cpp to
Arch. That is 17 MB installed instead of 225 MB.

!lto is not optional: makepkg's lto puts -flto=auto into CFLAGS, and ring
compiles hand-written assembly through cc, which then comes out as bitcode
and links to nothing.

sherpa-onnx-sys ships no C++ build; its build script downloads a prebuilt
static-lib archive. concat lists that archive as a checksummed source and
points the build script at it, with the version read out of upstream's
Cargo.lock by pkg.sh. concat-git cannot pin it - the version moves with
main - so there the build script fetches it.

Every upstream release is a v<version>-alpha.<n> prerelease published on a
push to main, several a day, and the release list is ordered by creation
rather than by version, so the newest is picked by publication date.

Only concat-git is published for now; concat and concat-bin are held back
with AUR_PUBLISH=false until that cadence has been lived with.

concat-bin/pkg.sh

@@ -0,0 +1,79 @@
+# concat-bin - Concat (https://github.com/jub0t/Concat), a free and
+# open-source CapCut replacement: a Tauri 2 shell around a Rust video engine.
+#
+# Upstream publishes a Linux .deb per release, so there is no build step
+# here: on a new version only pkgver, the asset name and the checksums are
+# refreshed and the PKGBUILD repackages the .deb.
+#
+# The project has no stable release yet. Its build workflow publishes a
+# "v<version>-alpha.<n>" prerelease for every green push to main, so /latest
+# is empty and every tag is a prerelease - the alphas are what there is to
+# package. They arrive several times a day, which is also how often this
+# package can move.
+#
+# The release list is not ordered by version: GitHub sorts it by creation
+# time, and upstream's alpha numbering has already run out of step with it
+# (v0.2.0-alpha.10 sits between alpha.2 and alpha.1). The newest release is
+# therefore picked by publication date rather than by list position.
+#
+# The asset name carries tauri.conf.json's version, not the tag - every alpha
+# of 0.2.0 ships WolfCut_0.2.0_amd64.deb - so it cannot be derived from
+# pkgver and is resolved through the API into the _asset variable.
+#
+# pkgver drops the hyphens from the tag (v0.2.0-alpha.15 -> 0.2.0alpha.15).
+# pacman sorts that older than a later plain 0.2.0 (`vercmp 0.2.0alpha.15
+# 0.2.0` is -1), so the prereleases upgrade to the eventual stable release on
+# their own and no epoch is needed.
+
+# Not on the AUR yet. concat-git goes up first; these two follow once the
+# alpha-per-push release cadence has been lived with for a while - upstream
+# publishes several a day, and each one is an AUR push (and, for concat, a
+# full Rust build in CI). Flip this to true to publish; until then the
+# PKGBUILD is still kept current and test-built here.
+AUR_PUBLISH=false
+
+UPSTREAM_REPO="jub0t/Concat"
+
+# newest published release whose tag looks like a version
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.draft | not) | select(.tag_name | test("^v[0-9]"))]
+          | sort_by(.published_at) | last | .tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag asset sha_deb sha_license
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  # e.g. WolfCut_0.2.0_amd64.deb - the version is tauri.conf.json's, not the tag's
+  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
+    | grep -E '_amd64\.deb$')"
+  [[ "$(wc -l <<< "$asset")" -eq 1 ]] || { echo "expected exactly one amd64 .deb, got: $asset" >&2; return 1; }
+
+  sha_deb="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
+    | sha256sum | cut -d' ' -f1)"
+  # the .deb ships no copyright file, so the license comes from the tag
+  sha_license="$(curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/$tag/LICENSE" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_asset=.*|_asset=\"$asset\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_deb' '$sha_license')|" \
+    "$pkgbuild"
+}