Name tarballs by content so a cached copy can never be stale

The tarball host serves archives as immutable for a year, but a rebuild of
the same JASP version reused jasp-desktop-<ver>-x86_64.tar.zst with new bytes,
so a cache could hand out the old tarball against the new PKGBUILD's sha256.
The name now carries the first 12 hex digits of its sha256, and the PKGBUILD
keeps that name locally too, so a stale download in the build directory no
longer fails the checksum either.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

packaging/PKGBUILD.in

@@ -51,7 +51,10 @@ depends=(
 # modules, and the rpath set at build time must survive untouched.
 options=('!strip' '!debug' '!libtool' '!staticlibs' '!zipman' '!purge' '!emptydirs')
 
-source=("jasp-desktop-${pkgver}-${pkgrel}-x86_64.tar.zst::@DOWNLOAD_URL@")
+# The remote name is content-addressed, so it is kept as the local name too: a
+# stale download left in the build directory can never be mistaken for the
+# current tarball and fail the checksum.
+source=("@DOWNLOAD_URL@")
 sha256sums=('@SHA256@')
 
 package() {