concat, concat-bin, concat-git: new packages

Concat (https://github.com/jub0t/Concat) is a Tauri 2 shell around a Rust
video engine, sold as a CapCut replacement. The project is mid-rename: the
binary, the desktop entry, the icons and the .deb asset all still say
WolfCut, so the packages install upstream's paths unchanged and add a
/usr/bin/concat symlink.

Upstream stages a static ffmpeg/ffprobe pair (180 MB) and whisper-cli
inside its bundle so the app runs on a machine with nothing installed.
Both lookups fall back to PATH, so concat-bin drops those two directories
and the source packages set WOLFCUT_SYSTEM_TOOLS=1 - the switch upstream
put in build.rs for exactly this case - leaving ffmpeg and whisper-cpp to
Arch. That is 17 MB installed instead of 225 MB.

!lto is not optional: makepkg's lto puts -flto=auto into CFLAGS, and ring
compiles hand-written assembly through cc, which then comes out as bitcode
and links to nothing.

sherpa-onnx-sys ships no C++ build; its build script downloads a prebuilt
static-lib archive. concat lists that archive as a checksummed source and
points the build script at it, with the version read out of upstream's
Cargo.lock by pkg.sh. concat-git cannot pin it - the version moves with
main - so there the build script fetches it.

Every upstream release is a v<version>-alpha.<n> prerelease published on a
push to main, several a day, and the release list is ordered by creation
rather than by version, so the newest is picked by publication date.

Only concat-git is published for now; concat and concat-bin are held back
with AUR_PUBLISH=false until that cadence has been lived with.

concat-git/pkg.sh

@@ -0,0 +1,35 @@
+# concat-git - Concat (https://github.com/jub0t/Concat) built from the main
+# branch. Same build as concat, see that package for why the Tauri binary
+# needs nothing but a JS toolchain and cargo, and why WOLFCUT_SYSTEM_TOOLS=1
+# is the right switch for a distribution package.
+#
+# The one difference: concat pins the prebuilt sherpa-onnx static-lib archive
+# as a checksummed source, which it can because the version comes from a
+# tagged Cargo.lock. Here it moves with main, so sherpa-onnx-sys' build
+# script downloads it and build() needs the network.
+#
+# VCS packages are not version-tracked here on purpose. The AUR copy of a -git
+# PKGBUILD carries only a snapshot of pkgver; the real version comes from
+# pkgver() when the user builds it. Upstream publishes an alpha release for
+# every green push to main, several times a day, so following main here would
+# mean several AUR pushes a day that change nothing for anyone.
+# latest_version() therefore reports the pkgver that is already in the
+# PKGBUILD, which makes the update run a no-op: the package is rebuilt,
+# re-checked and pushed only when the packaging itself changes.
+#
+# When that happens, makepkg refreshes the pkgver snapshot in the PKGBUILD as
+# part of the test build, so the committed snapshot follows along by itself.
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(rust npm git webkit2gtk-4.1 gtk3 libsoup3 alsa-lib)
+
+latest_version() {
+  grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+# Unreachable: latest_version() never reports a version other than the current
+# one. The git source carries SKIP checksums, so there would be nothing to do.
+refresh_checksums() {
+  :
+}