libva-v4l2-request-fourier: bump pin to 2860d75 (#13 bounds-check fix)

Bumps both the Arch PKGBUILD and the Debian build-deb.sh pins to PR
#14 merge — codec_store_buffer bounds-checks for VASliceDataBufferType.
Picks up the SIGSEGV fix for mpv --hwdec=vaapi-copy on resolution
upshift mid-stream (issue #13).

Dual-pin so check-already-published.sh detects both pool ABIs as
needing a fresh build.

arch/libva-v4l2-request-fourier/PKGBUILD

@@ -24,29 +24,28 @@ pkgname=libva-v4l2-request-fourier
 epoch=1
 _upstreampkg=libva-v4l2-request
 
-# Pin the fork tip. 77f9236 = PR #12 merge "av1: populate
-# V4L2_CID_STATELESS_AV1_SEQUENCE in codec_set_controls (#11 libva side)"
-# — addresses the libva-side portion of marfrit/libva-v4l2-request-fourier#11.
-# Adds src/av1.{c,h} with av1_set_controls that maps VAAPI's
-# VAPictureParameterBufferAV1.seq_info_fields onto struct
-# v4l2_ctrl_av1_sequence and queues V4L2_CID_STATELESS_AV1_SEQUENCE via
-# S_EXT_CTRLS. The daedalus_v4l2 daemon track is the consumer that turns
-# the ctrl into an OBU_SEQUENCE_HEADER and prepends it to the slice
-# bitstream so libdav1d can parse the (sequence-header-stripped) OUTPUT
-# buffer that ffmpeg-vaapi delivers. Until the daemon side lands the ctrl
-# is just sitting in the request unused — no-cost no-op for HW decoders
-# (vpu981 parses OBU bytes directly).
+# Pin the fork tip. 2860d75 = PR #14 merge "picture: bounds-check
+# codec_store_buffer slice writes against source_size (#13)" — addresses
+# marfrit/libva-v4l2-request-fourier#13. Guards the three append sites
+# in codec_store_buffer's VASliceDataBufferType branch (H.264 Annex-B
+# start code, VP8 uncompressed-header pad, slice payload) against the
+# OUTPUT pool slot's fixed sizeimage; returns
+# VA_STATUS_ERROR_ALLOCATION_FAILED with a request_log line instead of
+# memcpy'ing past the mmap on a resolution upshift mid-stream (SIGSEGV
+# in mpv --hwdec=vaapi-copy, heap-corruption hazard in Firefox RDD).
+# The root-cause refactor (re-init OUTPUT pool / re-create surfaces on
+# resolution change, or grow source_data on demand) is tracked as the
+# follow-up backlog item; this PR is the memory-safety floor.
 #
-# Prior pin (c1bb444) = PR #9 merge — h264_set_controls
-# max_num_ref_frames fallback + libva-boundary instrumentation for the
-# daedalus consumer-strict path (issue #8 libva side).
-_commit=77f92364661419f6e5a7bd827c1b845b4e426569
+# Prior pin (77f9236) = PR #12 merge — av1_set_controls
+# (V4L2_CID_STATELESS_AV1_SEQUENCE for the daedalus daemon track).
+_commit=2860d75afe6a8e34df6afb508ff85c822bf9e908
 
 # Project version from meson.build (1.0.0) + commit count + short sha,
 # matching the ffmpeg-v4l2-request-fourier convention. Recomputed at
 # build time by pkgver() below; the static value here is a placeholder
 # so AUR-style consumers see something coherent before src/ exists.
-pkgver=1.0.0.r386.77f9236
+pkgver=1.0.0.r388.2860d75
 pkgrel=1
 pkgdesc="VA-API backend for V4L2 stateless decoders (multiplanar fork — fourier umbrella)"
 arch=('aarch64')