Publish the PKGBUILD next to the tarball

The tarball host lists each package's PKGBUILD beside its tarballs, but the
JASP one was only ever placed there by hand and went stale as soon as CI
published a new build. Upload the same PKGBUILD the AUR job gets, once the
tarball's public URL has been verified, via a dotfile and a rename so the
host's index never sees a partial file. Not fatal to the AUR release.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/build.yml

@@ -147,8 +147,30 @@ jobs:
           fi
           echo "public URL serves the expected bytes"
 
-      # Only the PKGBUILD and metadata cross the job boundary — the tarball
-      # itself already lives on GitHub Releases.
+      # The same PKGBUILD the AUR gets, next to the tarball, so the copy on
+      # the tarball host always matches the AUR package. Written to a dotfile
+      # first and renamed, so the host's index never sees a half-written file.
+      # Cosmetic for the AUR release, so a failure here does not stop it.
+      - name: Publish PKGBUILD next to the tarball
+        if: vars.PUBLISH == 'true'
+        continue-on-error: true
+        env:
+          TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
+          TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
+          TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/pkgbuild_key
+          chmod 600 ~/.ssh/pkgbuild_key
+          dest="${TARBALL_PATH}/jasp-desktop-bin.PKGBUILD"
+          ssh -i ~/.ssh/pkgbuild_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            "root@${TARBALL_HOST}" \
+            "cat > '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' && mv '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' '$dest' && chmod 644 '$dest'" \
+            < PKGBUILD
+          echo "PKGBUILD published next to the tarball"
+
+      # Only the PKGBUILD and metadata cross the job boundary; the tarball
+      # itself already lives on the tarball host.
       - name: Hand PKGBUILD to the AUR job
         if: vars.PUBLISH == 'true'
         uses: actions/upload-artifact@v3