packaging: daily automated AUR rebuild for the [tanin] repo

A systemd user timer (daily) drives aur-autoupdate.sh, which rebuilds the
AUR-only deps (eww-git, tiramisu-git, waypaper, calamares, …) in a clean
devtools chroot and refreshes tanin.db. Non -git packages are skipped when
their AUR version is unchanged (RPC check) so heavy ones like calamares
aren't rebuilt for nothing; -git packages rebuild every run.

Unattended: a sudoers drop-in grants passwordless access to the chroot
helpers. Publishing is a TANIN_PUBLISH_CMD hook (no-op until hosting is
wired) — the job refreshes the local repo dir for now.

One-time: aur-autoupdate.sh setup (installs devtools, makes the chroot).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/systemd/tanin-aur-update.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=TANINUX [tanin] repo — daily AUR rebuild
+Documentation=file:%h/projects/taninux/packaging/aur-autoupdate.sh
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# Adjust the path if your checkout lives elsewhere.
+ExecStart=%h/projects/taninux/packaging/aur-autoupdate.sh run
+# Be a good citizen — this is a background rebuild, not interactive work.
+Nice=15
+IOSchedulingClass=idle
+# Uncomment + set once hosting is wired, e.g.:
+# Environment=TANIN_PUBLISH_CMD=rsync -a --delete %h/projects/tanin-repo/ host:/srv/tanin/
+
+[Install]
+WantedBy=default.target

packaging/systemd/tanin-aur-update.sudoers

@@ -0,0 +1,7 @@
+# Passwordless chroot helpers so the daily AUR rebuild runs unattended.
+# Install:  sudo install -m440 tanin-aur-update.sudoers /etc/sudoers.d/tanin-aur-update
+# Validate: sudo visudo -cf /etc/sudoers.d/tanin-aur-update
+#
+# Replace "karim" if the timer runs as a different user. These are exactly the
+# helpers devtools' makechrootpkg shells out to as root; nothing broader.
+karim ALL=(root) NOPASSWD: /usr/bin/makechrootpkg, /usr/bin/arch-nspawn, /usr/bin/mkarchroot

packaging/systemd/tanin-aur-update.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=TANINUX [tanin] repo — daily AUR rebuild (timer)
+
+[Timer]
+# Once a day; catch up after downtime; jitter so it's not on-the-dot.
+OnCalendar=daily
+Persistent=true
+RandomizedDelaySec=30m
+
+[Install]
+WantedBy=timers.target