chore(packaging): close sha256sum=SKIP TODO + ADR 012 + STRATEGY update

[ccross2]

Summary

Three docs+packaging hygiene changes, no version bump, no code path touched.

1. Closes packaging/aur/PKGBUILD sha256sums=('SKIP') TODO (since v0.1.0)

The PKGBUILD has shipped sha256sums=('SKIP') since v0.1.0 with a # TODO: compute real sha256sum at release time reminder. With v0.3.3 now published, the GitHub archive tarball URL resolves deterministically:

https://github.com/sovren-software/visage/archive/refs/tags/v0.3.3.tar.gz

Fetched + sha256sum'd: e018fcc08dbb3aba381306424fc1fd94eaddc0a5da0d47437f17487f29b76f99 (199,300 bytes).

PKGBUILD now declares the real hash + a bump-procedure comment for future maintainers:

# sha256 of the v$pkgver tarball at github.com/sovren-software/visage/archive/refs/tags/v$pkgver.tar.gz
# Compute via:
#   curl -fsSL https://github.com/sovren-software/visage/archive/refs/tags/v$pkgver.tar.gz | sha256sum
# Must be re-computed on every pkgver bump.
sha256sums=('e018fcc08dbb3aba381306424fc1fd94eaddc0a5da0d47437f17487f29b76f99')

makepkg will now reject tampered/corrupted downloads — the AUR integrity gate is finally active for visage.

2. Adds ADR 012 — Post-Launch Stabilization v0.3.2 + v0.3.3

docs/decisions/012-post-launch-stabilization-v0.3.2-v0.3.3.md documents the v0.3.x stabilization arc, the rationale + trade-offs + known limitations for each shipped fix, and the remaining work. Sections:

• Context (the silent v0.1.0-era PAM bug + the SIGTERM gap)
• 9 decisions with rationale (two prioritized releases, fleet PAM sweep, SIGTERM handler approach, devshell parity, X1 Carbon quirk, AUR LTO fix, sha256sum closure, dependency cohort, doc updates)
• Trade-offs accepted (v0.3.1 numerical skip, PAM-sweep-separate-from-docs: update Arch Linux installation instructions in README #27, defense-in-depth TimeoutStopSec, real-hash without source-URL change)
• Drawbacks / known limitations (manual sha256 bumps, PR docs: update Arch Linux installation instructions in README #27 open, Discussion When is Intel IPU6 / MIPI / libcamera camera stack support expected? #28 not posted, Issue chore(security): audit dependabot security alerts (14 open, severity 6 high / 3 moderate / 5 low) #33 alerts not triaged, bypass-merge precedent)
• Remaining work (PR docs: update Arch Linux installation instructions in README #27 wait clock, Discussion When is Intel IPU6 / MIPI / libcamera camera stack support expected? #28, security alerts, CODEOWNERS, v0.4.0 packaging arc)

3. Updates docs/STRATEGY.md "Where We Are" section

Bumped v0.3.0 → v0.3.3 with the bug-fix-wave context. Component table updated to reflect:

• Quirks DB now covers ASUS Zenbook 14 + Lenovo X1 Carbon Gen 9
• visaged ships dual-signal SIGINT+SIGTERM handler + TimeoutStopSec=10s
• pam-visage's corrected [success=done default=ignore] control flow
• AUR PKGBUILD with verified sha256sums
• NixOS module mentioned

Cross-reference to ADR 012 for the full story.

Trade-off

The PKGBUILD source URL still points at GitHub's git-archive endpoint (/archive/refs/tags/v$pkgver.tar.gz). GitHub has historically (2023) changed git-archive compression behavior in ways that broke pinned hashes for many AUR projects. If that happens again, this hash will mismatch and AUR users will see a makepkg integrity error.

Alternative not chosen: add a tarball generation step to the release workflow + point PKGBUILD at the release-asset URL. More work; defer to v0.4 packaging arc.

Scope

• No version bump. This is hygiene work that picks up on next release cut (v0.3.4 or v0.4.0).
• No code changes. crates/, flake.nix, Cargo.toml, and Cargo.lock untouched.
• No CHANGELOG entry yet — this lands in [Unreleased] once the next release cut adds an entry referencing it. The ADR 012 file itself is the canonical documentation.

Test plan

• CI: test job green (fmt/clippy/build/test) — no source change, expect pass.
• CI: build-deb produces a .deb cleanly (PKGBUILD comments don't affect the Debian build path).
• Manual smoke (Arch): makepkg --verifysource against the v0.3.3 source URL produces the matching sha256.
• No TODO markers remain in packaging/aur/PKGBUILD.

🤖 Generated with Claude Code