Add safe upstream release sync for Strata

[ryanrhughes]

What this does

Adds safe upstream-release syncing for Strata without leaving its embedded build commit stuck on the original v0.8.0 SHA.

• follows strict stable vX.Y.Z GitHub releases
• holds new releases for 24 hours
• verifies the archive root and checks its embedded Git commit against the release tag
• hashes the source archive before updating the PKGBUILD
• derives STRATA_BUILD_COMMIT from the pinned archive during the build

The recipe moves from 0.8.0-1 to 0.8.0-2 because the build inputs changed. A future version bump will reset pkgrel to 1 normally.

Current release

v0.8.1 is the newest release, but it is still inside the 24-hour quarantine. This PR deliberately does not bypass that window. Once it clears, the scheduled sync will open the normal version-bump PR.

I tested both paths: scheduled mode leaves v0.8.1 alone today, while an explicit bypass updates a disposable checkout to v0.8.1 with the independently reproduced SHA-256 and exact tag commit.

Validation

• current v0.8.0 source verification passed and derives commit 61b4b0bc74a5b8ca262c7c080e9fea57bba65ff5
• simulated sync produced v0.8.1, pkgrel=1, and source SHA-256 dca3b6af063f5d49257d27b61be1fa2dfffb1d9998c295382e564ce8e995de71
• full v0.8.1 package build passed all 384 tests and embedded commit a2ebf1b820acacbd9b55ffe0e0f204175a613104
• v0.8.1 adds no dependency changes; reviewed its update-install delta and found no blocking issue
• Gitleaks found no secrets in the three v0.8.1 commits
• sync and repository self-tests passed
• edge/RC/stable dry-runs passed on x86_64 and aarch64