ci(release): attach source archives to release and use them for AUR package

Gitea's /archive/ endpoint is disabled, which broke the AUR source download.
Build source tar.gz/zip with git archive, upload as release assets, and point
the PKGBUILD and checksum step at the release asset.

.gitea/workflows/release.yml

@@ -85,6 +85,13 @@ jobs:
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           makensis -DVERSION="${VERSION#v}" -DEXE="$PWD/relspec-windows-amd64.exe" -DOUT="$PWD/relspec-setup-windows-amd64.exe" windows/installer.nsi
 
+      - name: Build source archives
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          PREFIX="relspec-${TAG#v}"
+          git archive --format=tar.gz --prefix="${PREFIX}/" -o "relspec-${TAG}-source.tar.gz" "$TAG"
+          git archive --format=zip    --prefix="${PREFIX}/" -o "relspec-${TAG}-source.zip"    "$TAG"
+
       - name: Create release and upload assets
         run: |
           TAG="${{ github.event.inputs.tag || github.ref_name }}"
@@ -198,7 +205,7 @@ jobs:
           echo "Publishing AUR package version ${PKGVER}-${PKGREL}"
 
           # Compute SHA256 of the source archive from the same URL the PKGBUILD will download.
-          SHA=$(curl -fsSL "https://git.warky.dev/wdevs/relspecgo/archive/v${PKGVER}.zip" | sha256sum | cut -d' ' -f1)
+          SHA=$(curl -fsSL "https://git.warky.dev/wdevs/relspecgo/releases/download/v${PKGVER}/relspec-v${PKGVER}-source.zip" | sha256sum | cut -d' ' -f1)
 
           # Update PKGBUILD — keep remote source URL, bump version/checksum, and increment pkgrel for same-version rebuilds.
           sed -e "s/^pkgver=.*/pkgver=${PKGVER}/" \