Document binary provenance in the PKGBUILD header

Checked what the AUR actually requires rather than relying on my earlier
assumption. The submission guidelines say only that packages using prebuilt
deliverables must carry the -bin suffix; nothing requires the binary to come
from upstream, so -bin is correct and sufficient here.

There is no formal 'unofficial binary' flag, so disclose it where users look:
an explicit PROVENANCE block in the PKGBUILD comment header naming the tag,
commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc.

Corrects the README, which overstated the risk of a maintainer objecting.

scripts/gen-pkgbuild.py

@@ -68,8 +68,11 @@ def main() -> int:
     substitutions = {
         "@MAINTAINER@": args.maintainer,
         "@JASP_VERSION@": jasp_version,
+        "@JASP_TAG@": info["jasp_tag"],
+        "@JASP_COMMIT@": info["jasp_commit"],
         "@PKGREL@": str(pkgrel),
         "@BUNDLED_R@": info["bundled_r_version"],
+        "@QT_MINOR@": qt_minor,
         "@DOWNLOAD_URL@": download_url,
         "@SHA256@": info["sha256"],
     }