Document binary provenance in the PKGBUILD header

Checked what the AUR actually requires rather than relying on my earlier
assumption. The submission guidelines say only that packages using prebuilt
deliverables must carry the -bin suffix; nothing requires the binary to come
from upstream, so -bin is correct and sufficient here.

There is no formal 'unofficial binary' flag, so disclose it where users look:
an explicit PROVENANCE block in the PKGBUILD comment header naming the tag,
commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc.

Corrects the README, which overstated the risk of a maintainer objecting.

README.md

@@ -128,10 +128,27 @@ Actions → Build JASP binary and publish to AUR → Run workflow
          jasp_tag = v0.98.1   force = true
 ```
 
-## Caveat worth knowing
+## Where the binary comes from, and how that is disclosed
 
-AUR convention is that a `-bin` package repackages binaries published by upstream.
-Here upstream publishes no Linux binary, so this one is built by us. That is
-unusual, and a maintainer or TU may question it. It is not against the rules, but
-the package description and this README should stay honest about where the binary
-comes from.
+The AUR has no formal "unofficial binary" flag. What it has is the naming rule in
+[AUR submission guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submission):
+
+> Packages that use **prebuilt** deliverables, when the sources are available,
+> must use the `-bin` suffix.
+
+That rule is about the deliverable being prebuilt — it says nothing about who
+built it, so `-bin` is the correct and sufficient signal here even though the
+binary is ours rather than upstream's. The two rules that could bite do not:
+JASP is not in any official repository, and the AUR repo carries only `PKGBUILD`
+and `.SRCINFO`, never the makepkg tarball or a filelist.
+
+Disclosure is therefore by convention rather than by mechanism, in the two places
+a user actually looks:
+
+- the **comment header** at the top of the `PKGBUILD` (the same header the
+  guidelines require for maintainer info) states that upstream ships no Linux
+  binary and links to the build pipeline that produced this one;
+- the **`pkgdesc`** ends in `(prebuilt binary)`.
+
+Anyone who wants to verify can read `build/build-jasp.sh` in this repo and
+reproduce the tarball.