push-aur.sh: mktemp -d creates the work directory as 0700 root, so the
builder user could not enter it to run makepkg ('cd: Permission denied'),
and the git steps afterwards would refuse a tree owned by another user. Give
builder the whole tree for makepkg and hand it back to root before git.
record-state.sh: 'git diff --quiet' ignores untracked files, so the first
state.json was reported as unchanged and never committed, which would have
rebuilt and republished every night. Stage it before comparing.
Both were found by the first publishing run; push-aur.sh was then tested end
to end in a clean Arch container with a dummy key.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
agw
bdbd6f5978