aish: package v0.1.0 for arch + debian

aish is an AI-augmented conversational shell in LuaJIT 2.x with FFI
bindings to libcurl, GNU readline, and libc — no C extensions, no
build step. Source-of-truth: git.reauktion.de/marfrit/aish, tag v0.1.0
(tarball sha256 9ebc3939e028832e39391ae33efacb5ec9bcd99d123cbc8ca1cd6ca9a640b5b5).

The arch and debian recipes mirror the lmcp pattern (pure-Lua any-arch
package, no makefile, install copies modules directly):

  arch/aish/PKGBUILD           — depends=(luajit readline curl)
  debian/aish/build-deb.sh     — pure dpkg-deb, SOURCE_DATE_EPOCH pinned
  debian/aish/debian/{control,changelog,copyright}

Install layout, matching what main.lua's script-dir-relative package.path
expects after the wrapper execs `luajit /usr/share/lua/5.1/aish/main.lua`:

  /usr/bin/aish                              ← bin/aish wrapper
  /usr/share/lua/5.1/aish/{main,broker,context,executor,history,
                           mcp,renderer,repl,router,safety,secrets}.lua
  /usr/share/lua/5.1/aish/ffi/{curl,libc,pty,readline}.lua
  /usr/share/lua/5.1/aish/vendor/dkjson.lua
  /usr/share/doc/aish/{README.md,LICENSE,examples/config.lua}

CI: two new jobs in .gitea/workflows/build.yml at the end of file.
aish-any chains needs:lmcp-debian (parallel-DAG with claude-his-any,
serialized via the shared arch-aarch64 runner — avoids needless wait
through the unrelated fourier stack). aish-debian chains needs:aish-any.
Both invoke the standard check-already-published.sh fast-skip on no-
change pushes.

Sonnet review (per feedback_reviews_use_sonnet.md + bugfix-process
step 4): no blockers. Folded in two findings before commit: switched
needs: from mpv-fourier-aarch64 to lmcp-debian (cleaner DAG, faster
cold-build wall clock), removed the dead Build-Depends: debhelper-
compat line from debian/aish/debian/control (build-deb.sh doesn't
use debhelper).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -1556,3 +1556,179 @@ jobs:
         if: always()
         run: rm -f /root/repo_pass /root/.ssh/id_ed25519
 
+  # -------------------------------------------------------------------------
+  # aish (arch=any) — pure LuaJIT, one .pkg.tar valid on every pacman target.
+  # Same dual-arch publish pattern as lmcp / claude-his.
+  # -------------------------------------------------------------------------
+  aish-any:
+    needs: lmcp-debian   # parallel with claude-his-any (pure-Lua sibling),
+                         # serialized via the shared arch-aarch64 runner.
+                         # Avoids needless wait through the fourier stack.
+    runs-on: arch-aarch64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/aish)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo luajit readline curl
+
+      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
+          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
+        run: |
+          set -e
+          gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
+          rm -rf /root/.gnupg /root/repo_pass
+          mkdir -m700 -p /root/.gnupg
+          printf '%s' "$PASS" > /root/repo_pass
+          chmod 600 /root/repo_pass
+          printf '%s\n' "$PRIV" | gpg --batch --import
+          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
+
+      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
+          chmod 600 /root/.ssh/id_ed25519
+          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
+
+      - name: makepkg aish
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          rm -rf /tmp/build-aish
+          cp -r arch/aish /tmp/build-aish
+          chown -R builder:builder /tmp/build-aish
+          cd /tmp/build-aish
+          sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
+          ls -la *.pkg.tar.* | grep -v "\.sig$"
+
+      - name: sign aish
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd /tmp/build-aish
+          for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
+            [ -f "$f" ] || continue
+            gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
+                --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
+          done
+
+      - name: publish aish to both arches
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export GNUPGHOME=/root/.gnupg
+          printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
+          printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye
+
+          for target in aarch64 x86_64; do
+              stage="/tmp/arch-stage-$target"
+              rm -rf "$stage"; mkdir -p "$stage"; cd "$stage"
+              for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
+                curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f"
+              done
+              cp /tmp/build-aish/*.pkg.tar.* .
+              pkgs=()
+              for ext in xz zst gz; do
+                for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
+              done
+              if [ -f marfrit.db.tar.gz ]; then
+                for f in "${pkgs[@]}"; do
+                  name=$(echo "$f" | sed -E 's/-[0-9].*//')
+                  repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                    marfrit.db.tar.gz "$name" 2>/dev/null || true
+                done
+              fi
+              repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                --verify marfrit.db.tar.gz "${pkgs[@]}"
+              ln -sf marfrit.db.tar.gz        marfrit.db
+              ln -sf marfrit.files.tar.gz     marfrit.files
+              ln -sf marfrit.db.tar.gz.sig    marfrit.db.sig
+              ln -sf marfrit.files.tar.gz.sig marfrit.files.sig
+              retry rsync -avL --copy-unsafe-links \
+                -e 'ssh -i /root/.ssh/id_ed25519' \
+                ./ "mfritsche@nc.reauktion.de:arch/$target/"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
+
+  aish-debian:
+    needs: aish-any   # serialize after the Arch build to share the runner
+    runs-on: arch-aarch64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/aish)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install dpkg
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build aish .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/aish
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/aish
+          DEB=$(ls aish_*.deb | head -1)
+          # Push the .deb into hertz's incoming dir via rrsync.
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          # Trigger reprepro for each suite.
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+