packaging: daily automated AUR rebuild for the [tanin] repo

A systemd user timer (daily) drives aur-autoupdate.sh, which rebuilds the
AUR-only deps (eww-git, tiramisu-git, waypaper, calamares, …) in a clean
devtools chroot and refreshes tanin.db. Non -git packages are skipped when
their AUR version is unchanged (RPC check) so heavy ones like calamares
aren't rebuilt for nothing; -git packages rebuild every run.

Unattended: a sudoers drop-in grants passwordless access to the chroot
helpers. Publishing is a TANIN_PUBLISH_CMD hook (no-op until hosting is
wired) — the job refreshes the local repo dir for now.

One-time: aur-autoupdate.sh setup (installs devtools, makes the chroot).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/systemd/tanin-aur-update.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=TANINUX [tanin] repo — daily AUR rebuild (timer)
+
+[Timer]
+# Once a day; catch up after downtime; jitter so it's not on-the-dot.
+OnCalendar=daily
+Persistent=true
+RandomizedDelaySec=30m
+
+[Install]
+WantedBy=timers.target