PKGBUILD: pin source sha256 + wire real CI pipeline

- distcc-3.4 tarball hash + local support files hashed (no more SKIP)
- .gitea/workflows/build.yml now builds, signs, repo-adds and rsyncs
  to nc via the marfrit-repo-deploy key. Triggers on push to arch/**
  or manual workflow_dispatch.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

arch/distcc-avahi/PKGBUILD

@@ -23,16 +23,16 @@ conflicts=('distcc')
 replaces=('distcc')
 backup=('etc/conf.d/distccd')
 source=(
-    "https://github.com/distcc/distcc/releases/download/v${pkgver}/distcc-${pkgver}.tar.gz"
+    "${_pkgname}-${pkgver}.tar.gz::https://github.com/distcc/distcc/archive/refs/tags/v${pkgver}.tar.gz"
     "distccd.conf"
     "distccd.service"
     "distcc.tmpfiles"
 )
 sha256sums=(
-    'SKIP'  # pin when first built in CI
-    'SKIP'
-    'SKIP'
-    'SKIP'
+    '37a34c9555498a1168fea026b292ab07e7bb394715d87d8403e0c33b16d2d008'
+    '38cb1912bfa15efd762dd868e049bdbcd58f1a46065255bc4648f821ba516d65'
+    'a4f1d1bb21d61d41f22e918b448cfb852a6d95b0d3b922bd82805090cb2ce41a'
+    'd8aee2eb895c02a39e0f2b76fd4a5c9dce91405f1c443286ca324628eadbf3f1'
 )
 
 prepare() {