packaging: a native Arch package, so pacman owns and tracks the daemon

[Ryanmello07]

Stacked PR — depends on #5 (app id rename).
Opened against main because a cross-fork PR needs its base branch to exist in
this repo, so the diff below currently includes its parent's changes too.
Review after its parent lands.

---

Arch, CachyOS, EndeavourOS and Manjaro had exactly one daemon channel: the
install tarball. That means nothing on the machine knows the daemon is there.
pacman cannot list it, cannot verify it, cannot upgrade it, and pacman -R
cannot remove it — and the tarball can only complain about missing nftables or
fuse2 after it has already written files. This adds
urnetwork-daemon-<version>-<arch>.pkg.tar.zst, built the way the .deb and
.rpm already are.

Why nfpm and not a PKGBUILD

All the native packages are assembled from one meson install --destdir
staging tree through packaging/lib/common.sh's assemble_daemon_root(), so the
daemon inside each is the same bytes by construction rather than by review. A
PKGBUILD would be a fourth independent copy of the installed-path table, and it
would need an Arch machine or a container to run makepkg — which neither the
build server nor the workflow's ubuntu:22.04 container is. nfpm is pure Go down
to its zstd, so this builds anywhere the .deb does.

An AUR recipe remains reasonable later as a discovery channel. It is not a
replacement for a first-party binary package.

Three things make-arch.sh does that make-deb.sh does not

Each because pacman fails in a way the other formats do not:

1. It moves the unit to /usr/lib/systemd/system. On Arch, /lib is a
   symlink to usr/lib owned by the filesystem package, and a .pkg.tar.zst
   carrying any member under lib/ does not merely offend a guideline — pacman
   aborts the transaction with /lib exists in filesystem (owned by filesystem) and installs nothing.

2. It folds the whole version into pkgver, because pacman's pkgver may not
   contain - at all and nfpm silently mangles the other obvious shapes. The
   file is still named for the release version verbatim: pacman does not parse
   filenames, it reads .PKGINFO.

3. It pins one timestamp and verifies the .MTREE, because pacman -Qkk —
   the integrity check a careful user runs against a VPN daemon — is broken by
   two separate nfpm behaviours, both silent. type: tree writes Go's unmasked
   fs.FileMode for every directory, so every directory reports as altered
   forever; and the tar header mtime and the .MTREE time= come from different
   clocks. Both are worked around, and the script asserts the workarounds held
   rather than trusting them.

Install/remove hooks

They mirror the .deb's maintainer scripts, with the one pacman ordering
difference that matters: pre_remove stops and disables the unit while the
binary still exists, so its ExecStopPost can tear the nftables ruleset down.

Not for SteamOS

SteamOS is Arch-family but immutable. Its /usr is read-only, pacman -U there
needs steamos-readonly disable, and the next system update reverts it.
Immutable Arch hosts stay on the install tarball, which installs under
/usr/local. packaging/distro-smoke.sh says so on a SteamOS host.

The tarball guards were hypothetical; now they are live

packaging/tarball/install.sh and uninstall.sh already refused to touch paths
that pacman -Qo reports as owned, but both comments described it as protection
against a future AUR package. It is now a real conflict against our own
package, and both comments say so — otherwise the next reader assumes the check
is theoretical and weakens it.

Verified

bash -n on make-arch.sh, all six packaging/arch/scripts/*, distro-smoke.sh
and both tarball scripts; yaml.safe_load on packaging/arch/nfpm.yaml; every
path make-arch.sh references exists in the tree.

Why this is split this way

It is the single largest body of genuinely new code in the series (≈1400 lines),
it is self-contained, and it needs a reviewer who cares about pacman semantics —
not the same reviewer who should be checking an app id or a screenshot. It only
needs PR 2 underneath it, so it does not have to queue behind the icon and
Flathub work.

One note on comment references

Four comments in packaging/make-arch.sh and packaging/arch/nfpm.yaml cite
.github/workflows/beta-build.yml as the source of the release-asset contract.
That mirrors the existing house style — packaging/make-rpm.sh,
packaging/rpm/nfpm.yaml, docs/DISTRO-SUPPORT.md and docs/linux_agent_help.md
on main all reference that same path today. They were left as-is for
consistency. If you would rather those references be repointed at whatever
workflow owns the contract in this repo, say so and it is a one-line change in
each.