libva-v4l2-request-fourier: bump pin to 2860d75 (#13 bounds-check fix)

Bumps both the Arch PKGBUILD and the Debian build-deb.sh pins to PR
#14 merge — codec_store_buffer bounds-checks for VASliceDataBufferType.
Picks up the SIGSEGV fix for mpv --hwdec=vaapi-copy on resolution
upshift mid-stream (issue #13).

Dual-pin so check-already-published.sh detects both pool ABIs as
needing a fresh build.

debian/libva-v4l2-request-fourier/build-deb.sh

@@ -10,22 +10,23 @@
 # Upstream fork: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 set -euo pipefail
 
-# Same pin as the Arch PKGBUILD.  77f9236 = PR #12 merge "av1:
-# populate V4L2_CID_STATELESS_AV1_SEQUENCE in codec_set_controls
-# (#11 libva side)" — adds src/av1.{c,h} with av1_set_controls that
-# maps VAAPI's VAPictureParameterBufferAV1.seq_info_fields onto
-# struct v4l2_ctrl_av1_sequence and queues V4L2_CID_STATELESS_AV1_
-# SEQUENCE via S_EXT_CTRLS.  The daedalus_v4l2 daemon track is the
-# consumer that turns the ctrl into an OBU_SEQUENCE_HEADER and
-# prepends it to the slice bitstream so libdav1d can parse the
-# (sequence-header-stripped) OUTPUT buffer that ffmpeg-vaapi
-# delivers.
+# Same pin as the Arch PKGBUILD.  2860d75 = PR #14 merge "picture:
+# bounds-check codec_store_buffer slice writes against source_size
+# (#13)" — guards the three append sites in codec_store_buffer's
+# VASliceDataBufferType branch (H.264 Annex-B start code, VP8
+# uncompressed-header pad, slice payload) against the OUTPUT pool
+# slot's fixed sizeimage; returns VA_STATUS_ERROR_ALLOCATION_FAILED
+# with a request_log line instead of memcpy'ing past the mmap on a
+# resolution upshift mid-stream.  Fixes a SIGSEGV in mpv
+# --hwdec=vaapi-copy and a heap-corruption hazard in Firefox RDD.
+# The root-cause refactor (re-init OUTPUT pool / re-create surfaces
+# on resolution change, or grow source_data on demand) is tracked
+# as the follow-up backlog item; this is the memory-safety floor.
 #
-# Prior pin (c1bb444) = PR #9 merge — h264_set_controls
-# max_num_ref_frames fallback + libva-boundary instrumentation for
-# the daedalus consumer-strict path (issue #8 libva side).
-UPSTREAM_COMMIT=77f92364661419f6e5a7bd827c1b845b4e426569
-PKGVER=1.0.0+r386+g77f9236
+# Prior pin (77f9236) = PR #12 merge — av1_set_controls
+# (V4L2_CID_STATELESS_AV1_SEQUENCE for the daedalus daemon track).
+UPSTREAM_COMMIT=2860d75afe6a8e34df6afb508ff85c822bf9e908
+PKGVER=1.0.0+r388+g2860d75
 PKGREL=1
 
 HERE=$(dirname "$(readlink -f "$0")")