Self-host tarballs on asger.weirsoe.dk instead of GitHub Releases

Serve from /srv/tarballz on CT148 via a 'location /tarballz/' alias, NOT
from under /var/www/asger: the asger-web deploy swaps that whole directory
atomically, so tarballs kept inside it would be deleted on the next site
deploy. CT148's rootfs was 3G with 2.7G free - one tarball would have
filled it - so it is grown to 15G; speedy's thin pool has room even though
vgs reports the VG nearly full.

Publishing uploads to a .part name and renames on arrival so a download can
never see a truncated file, verifies sha256 on the host, then fetches the
public URL and checks it against the sha256 baked into the PKGBUILD. Both
checks run before the AUR push, so the package cannot go out pointing at a
missing file. Old tarballs are pruned to the newest three.

GH_TOKEN is kept but demoted to an optional GITHUB_PAT for R module
downloads; it no longer has anything to do with publishing.

scripts/gen-pkgbuild.py

@@ -40,8 +40,8 @@ def main() -> int:
     ap.add_argument("--build-info", required=True)
     ap.add_argument("--template", required=True)
     ap.add_argument("--out", required=True)
-    ap.add_argument("--gh-owner", required=True)
-    ap.add_argument("--gh-repo", default="jasp-desktop-bin")
+    ap.add_argument("--base-url", required=True,
+                    help="public directory the tarball is served from")
     ap.add_argument("--maintainer", required=True)
     ap.add_argument("--pkgname", default="jasp-desktop-bin")
     args = ap.parse_args()
@@ -58,10 +58,7 @@ def main() -> int:
         print(f"new version {jasp_version}: pkgrel 1")
 
     tag = f"v{jasp_version}-{pkgrel}"
-    download_url = (
-        f"https://github.com/{args.gh_owner}/{args.gh_repo}"
-        f"/releases/download/{tag}/{info['tarball']}"
-    )
+    download_url = f"{args.base_url.rstrip('/')}/{info['tarball']}"
 
     qt_minor = info["qt6_minor"]