fix: sync release PKGBUILDs from tagged CI

[seryogakovalyov]

Summary

• dispatch the pacman repository workflow after tagged release assets are signed
• allow an explicit workflow-dispatch version to commit synchronized packaging files
• synchronize the source and binary PKGBUILDs from v0.7.1 to v0.8.4 using the signed release manifest

Why

The CI workflow creates GitHub Releases with the repository token. GitHub suppresses most follow-up workflow events created by that token, so the separate release-published trigger does not reliably start pacman-repo.yml. As a result, both committed PKGBUILDs remained at v0.7.1 through the v0.8.x tags.

workflow_dispatch is explicitly allowed to start a new workflow from repository-token automation. The tagged sign job now invokes that path only after SHA256SUMS and its signature have been attached. A versionless manual repository rebuild remains commit-free.

Validation

• packaging/sync-release.sh 0.8.4
• bash -n packaging/sync-release.sh packaging/aurscan/PKGBUILD packaging/aurscan-bin/PKGBUILD
• git diff --check
• go test -mod=vendor ./...