Add hardened Flea package to fast ring

[ryanrhughes]

What this does

Adds Flea 0.1.2 to the fast ring as a source-built, x86_64 package. It installs the binary, desktop entry, icon, QML UI, and Omarchy QML links.

Security review

The published v0.1.2 tag was not safe to ship as-is. It had four blocking issues that are already fixed on the upstream hardening branch:

• option injection in archive and ImageMagick subprocesses
• unsafe decoder fallback when bwrap or prlimit is unavailable
• shell injection through a Dropbox share URL
• a symlink race while copying files

The PKGBUILD applies those four exact upstream patches from thisisgm/flea#2, with every source pinned by SHA-256. Future releases are rejected unless all four security invariants are present.

After applying the patches:

• RustSec audit: 0 vulnerabilities
• Gitleaks: no secrets across all 48 commits
• v0.1.2 tag signature and source archive verified
• reviewed filesystem mutation, archive handling, decoder sandboxing, QML process calls, network mounts, launcher/open behavior, config writes, and unsafe FFI
• decoders run through Bubblewrap with resource limits and now fail closed

No blocking findings remain in the packaged result. Recursive file operations still have low-impact, same-user path races; Flea does not cross a privilege boundary.

Upstream sync

Adds a strict GitHub Releases sync hook with the normal 24-hour quarantine. Since upstream does not publish a checksum manifest, the hook hashes the release tarball itself. It only emits an update after validating the archive structure and the four required security fixes.

Validation

• clean makepkg build and source verification
• 336 Rust tests passed
• 1,013 QML checks passed
• packaged binary smoke test passed
• PIE, full RELRO, non-executable stack, no RPATH/RUNPATH
• current, simulated future, and deliberately unsafe sync cases verified
• edge/RC/stable OPR dry-runs passed
• repository self-tests passed

Flea is x86_64-only for now because upstream's aarch64 build is currently broken: thisisgm/flea#13.